Feature Request: Add DDR support (SVCB/HTTPS record) for automatic DoH discovery on Android 13+

1

Hello dnsforge.de team,

Thank you for providing such a reliable and privacy-focused DNS service!

I would like to suggest a small but impactful improvement that would benefit Android users — especially those connecting from public or restrictive networks (hotels, airports, corporate/government Wi-Fi), where outbound port 853 (DoT) is frequently blocked by firewalls, causing Private DNS to fail and, in „Strict“ mode, breaking internet connectivity entirely.

Current situation

When a user manually enters dnsforge.de in Android’s „Private DNS“ setting, the system defaults to DNS-over-TLS (port 853). If that port is blocked, the connection fails, even though your DoH endpoint (https://dnsforge.de/dns-query) over port 443 would work perfectly fine in the same network.

Proposed solution: DDR (Discovery of Designated Resolvers)

Android 13+ supports automatic resolver discovery via DDR, as defined in:

  • RFC 9461 – Service Binding Mapping for DNS Servers
  • RFC 9462 – Discovery of Designated Resolvers (DDR)

This mechanism allows a device that already trusts a hostname (e.g., dnsforge.de) to query a special discovery record and automatically learn about alternative encrypted transports — including DoH — offered by the same resolver, without any manual URL configuration.

Required DNS record

Since your DoH endpoint is already available at https://dnsforge.de/dns-query, publishing the following record would enable full DDR support:

_dns.dnsforge.de. 7200 IN HTTPS 1 . alpn=„h2,h3“ dohpath=„/dns-query{?dns}“

Notes on the record:

  • The owner name must be _dns.dnsforge.de (per RFC 9461), not dnsforge.de directly — the latter is reserved for regular web service binding.
  • The dohpath parameter must be a URI Template (RFC 6570) containing the {?dns} variable, as required by RFC 8484/9461.
  • alpn="h2,h3" advertises HTTP/2 and HTTP/3 support for the DoH endpoint (adjust if you don’t support HTTP/3 yet).

Benefit for users

With this record in place, Android 13+ users who type dnsforge.de into Private DNS settings will automatically be able to fall back to (or prefer) DoH over port 443 whenever port 853 is blocked — with zero extra configuration and no need for third-party apps to manually specify the DoH URL.

Best regards, Ross

2

Great suggestion and you’re absolutely right about the problem! Port 853 being blocked on restrictive networks is a real pain point for Android users in strict mode.

We’ve now added the HTTPS/SVCB record for DDR support:

_dns.dnsforge.de. 300 IN HTTPS 1 . alpn="h2,h3" dohpath="/dns-query{?dns}"

This allows DDR-capable clients to automatically discover and upgrade to DoH over port 443 when DoT on port 853 is blocked. Apple devices (iOS 16+, macOS Ventura+) will benefit from this immediately. Android native DDR support is still limited, but this future-proofs the setup for when Google rolls it out more broadly.

For Android users struggling with blocked port 853 right now, we recommend using our DoH endpoint directly in your browser or a DoH-capable app in the meantime.

Thanks for the detailed and well-researched feature request!

3

Thanks for getting this implemented so perfectly and so fast, and for taking the suggestion seriously.