AEU DNS Complete Guide

The easiest way is the AEU program: it does everything on its own and, if anything goes wrong, it puts DNS back the way it found it.

1. Open the Setup page, pick the profile and go to the Windows tab.
2. Copy the command from the first box, the one for the AEU program.
3. Right-click the Start button and choose Terminal (Administrator) or PowerShell (Administrator).
4. Paste the command and press Enter: it asks for the password of your AEU account, the same one you sign in to the panel with.
5. Wait for the last line: before it closes, the command checks by itself that DNS answers.

Alternatively: you can set it up by hand, with nothing to install: Settings, Network & Internet, your connection, Edit DNS settings, Manual, IPv4 on, our addresses as DNS servers, and DNS over HTTPS: On (manual template) with the DoH address of your profile.

What you will see: the step lines scrolling past and, at the end, the confirmation that the profile is configured. In the network settings Windows writes Encrypted next to the DNS server.

How to check: open the Analytics page, pick the profile and the one-day period: within a few minutes the queries go up and the device appears among the connected ones.

If it does not work: if it says PowerShell is not elevated, open it again as administrator. If it answers with a credentials error, go back to the Setup page and copy the command again, because it expires. To go back there is the uninstall command, on the same tab.

On Windows 10 there is no system DNS over HTTPS (that needs Windows 11). The only route that really encrypts is installing a program, and the simplest one is AEU.

1. Setup page, Windows tab: copy the command for the AEU program.
2. Open PowerShell as administrator and paste the command.
3. Enter the password of your AEU account when it asks for it.
4. From then on the program keeps the queries on the encrypted channel, even if an application tries to use another DNS.

Alternatively: on the same tab, the one-click setup for DoT or DoH3 installs a small third-party program (AdGuard dnsproxy, open source) that acts as an encrypted bridge towards us.

What you will see: the command window lists the steps and closes with the check that DNS answers.

How to check: Analytics page: queries going up and the device among the connected ones.

If it does not work: do not just type our numeric addresses into the network properties: that is the unencrypted route on port 53, it encrypts nothing, and it works only if your address is linked to the profile.

Two routes: the AEU program from the Terminal, or the configuration profile, which is the form Apple asks for with DoH and DoT.

1. Setup page, macOS tab: copy the command and paste it into the Terminal.
2. It asks for the administrator password of the Mac and the password of your AEU account.
3. Alternatively download the configuration profile from the same tab and open the downloaded file.
4. Go to System Settings, General, VPN & Device Management (on macOS 12 and earlier: System Preferences, Profiles), open the AEU DNS profile and confirm.

Alternatively: the profile installs only with a click from a person: Apple does not allow it from the command line. If the command tells you to open the settings, that is normal.

What you will see: the profiles panel shows AEU DNS with the installed status.

How to check: open the Terminal and type scutil --dns: ours has to show up among the servers. Alternatively look at the Analytics page.

If it does not work: if the profile does not show up, find the downloaded file and open it again: some versions of macOS leave it waiting without saying so. To take it off, remove the profile from the same panel or use the uninstall command on the Setup page.

The AEU program is the fastest route. If you would rather use what you already have, the panel prepares the configuration for the most common programs.

1. Setup page, Linux tab: copy the command.
2. Paste it into a terminal: it asks for the administrator password of the computer and the password of your AEU account.
3. At the end the command checks that resolution works and, if it does not, puts the previous configuration back.
4. To take everything off there is the uninstall command, on the same tab.

Alternatively: on the same tab there is ready-made configuration for systemd-resolved, Stubby, Unbound, cloudflared, dnscrypt-proxy, AdGuard Home and Pi-hole: pick the one you already use, each with its own install and removal command.

What you will see: the terminal lists the numbered steps and closes with the resolution check.

How to check: ask for any domain and look at the Analytics page. With systemd-resolved, resolvectl status shows the configured server.

If it does not work: if something stops resolving after the install, almost always another local DNS service is still running: launch the uninstall command, which puts everything back as it was, and try again.

The AEU DNS app is the easiest route and it does not ask you to copy anything. Alternatively Android has its own system Private DNS.

1. Install the AEU DNS app from the link on the Setup page, App tab.
2. Sign in with your account, pick the profile and turn the protection on.
3. Without the app: Settings, Network & Internet, Private DNS, Private DNS provider hostname.
4. Type the hostname of your profile and save.

Alternatively: in front of the code you can put the name you gave the profile, and only that, to recognise the device: the exact form is written out for you on the Setup page, with the button that copies it. Any other word is refused and the device is left without DNS.

What you will see: the Private DNS entry stays On with the name you typed.

How to check: if the name were wrong Android would refuse to save, so saving is already half the check. Then look at the Analytics page.

If it does not work: if it does not save, check you have not typed https:// in front or a slash at the end. If the profile is in SECURE or QUANTUM mode the hostname is not enough: you need the certificate, and on Android the app installs it.

Here too the AEU DNS app is the easiest route. Alternatively you install a configuration profile.

1. Install the AEU DNS app and sign in with your account.
2. Without the app: from the Setup page, iOS tab, download the configuration profile.
3. Open Settings, General, VPN & Device Management: the downloaded profile is waiting there.
4. Open it, tap Install and confirm with the device passcode.

What you will see: the AEU DNS profile shows up in VPN & Device Management, installed.

How to check: open the Analytics page and check that the device shows up among the connected ones.

If it does not work: if the profile is not waiting there, download it again using Safari: other browsers sometimes do not hand the file to the system. To remove it, tap the profile and choose Remove Profile.

From the router you protect every device on the network, even the ones you cannot install anything on. The router uses plain DNS, so first you have to link your address.

1. From the home network open the Linked IP page and click Link This IP.
2. Sign in to the router panel (the address is usually printed underneath the device).
3. Find the DNS settings and type our three addresses, in order.
4. If the router supports IPv6, add the three long addresses as well.
5. Save, restart the router, then restart or reconnect the devices so they pick up the new DNS.

What you will see: the router status page shows the new DNS servers.

How to check: from a device on the network open a site you put on your denylist: the AEU block page has to appear. Then look at Analytics.

If it does not work: no answer at all almost always means the address is not linked: go back to the Linked IP page. If your provider changes your address often, bookmark the update link. Some routers force the provider DNS and will not let you change it: in that case set up the individual devices.

It is the quickest way to try it out, but it protects only that browser: the rest of the device carries on as before.

1. Firefox: Settings, Privacy & Security, DNS over HTTPS, choose Max Protection and then Custom.
2. Chrome, Edge and Brave: Settings, Privacy and security, Security, Use secure DNS, then Custom.
3. Paste the DoH address of your profile and close the settings.

Alternatively: Safari has no setting of its own: it follows the DNS of the Mac or the iPhone, so use the guide for that system.

What you will see: the browser shows the address you pasted as the custom provider.

How to check: open the Privacy Test on this site: the DNS section has to show the test domains blocked.

If it does not work: if nothing changes, check that you pasted the whole address, including /dns-query at the end. And remember that the apps outside the browser are still uncovered: to cover the whole device, use the program or the app.

What it is: Ready-made lists of unwanted sites: ads, dangerous sites, adult content and more.

What it is for: They block thousands of sites by themselves, without you writing each one.

How: Privacy page, Domain Lists box: turn on the categories you want, for example ads or threats. Next to each one it says how many entries it holds.

What it is: Stops banners, popups and the companies that follow what you do online.

What it is for: Pages open faster, cleaner and more private, even inside apps.

How: It is already included in the lists: in Privacy turn on the ads and tracking category.

What it is: Your personal list of sites you always want blocked, chosen by you.

What it is for: Ban a specific site for yourself or your kids, for example a social network or a gaming site, even if the automatic lists do not block it.

How: Denylist page: type the site name, the one you see in the browser bar, and save. It also blocks all of its sub-addresses.

What it is: Your personal list of sites that must always work.

What it is for: Recover a useful site, for example your bank or your work site, that an automatic list blocked by mistake.

How: Allowlist page: type the site name and save. The allowlist takes precedence over the automatic blocks and over your denylist.

What it is: Blocks adult content, gambling, social, games and streaming, one category at a time.

What it is for: Protect children and, with Recreation Time, grant time slots in which some categories are lifted.

How: Privacy page: turn on the categories to block and, if you want, add a Recreation Time rule with the hours.

What it is: Forces safe mode on the search engines and on YouTube.

What it is for: Hides adult results and videos, handy on children's devices.

How: Privacy page, Advanced Protections box: turn on Enforce SafeSearch and YouTube Restricted. They are off by default.

What it is: Blocks sites that spread viruses, scams (phishing) and addresses created automatically by malicious programs.

What it is for: Defends you even from new or disguised dangerous sites that the normal lists do not know yet.

How: Privacy page, Advanced Protections box: keep the four protections on. They are recommended for everyone and they are already on by default.

What it is: They make an address point to another place chosen by you.

What it is for: Useful for home networks, development, or to reach an internal device with an easy name instead of its number.

How: Settings, DNS Rewrites box: type the easy name and the target address (for example the address of the device at home), then save.

What it is: Small technical tweaks to make answers a little faster.

What it is for: Slightly faster browsing on your devices. They are optional and off by default.

How: Settings, Performance box: you can turn on Cache Boost. If in doubt, leave them off.

What it is: Every profile has a level: STANDARD, SECURE or QUANTUM.

What it is for: In SECURE and QUANTUM the profile certificate has to be installed on the device: without it, the request is refused. The certificate is one per profile, not per device.

How: Certificates page: download the format that suits your device (there are six) and install it following the guide.

What it is: Makes protection work even on devices that cannot install anything.

What it is for: Protect all the devices on the same home network, not just phone and computer.

How: Privacy page, Advanced Protections box: keep Allow DNS53 devices on the same network turned on. You also need your address linked to the profile.

Example Smart TV, PlayStation, printer

What it is: The numbers behind your queries: how many, how many blocked, and which devices are using the profile right now.

What it is for: See whether the protection is really working, and which route your queries are taking.

How: Analytics menu: pick the profile and the period. There is no list of the sites you visited, because we do not record it.

What it is: A strong password plus two-step verification (2FA).

What it is for: Stop someone else from getting into your account and changing your protections.

How: Account: change the password and turn on 2FA with an app like Google Authenticator or Authy.

A high score is good news, but it does not answer everything. In particular it does not tell you:

• which route your queries are taking, that is whether you are really on an encrypted channel or on port 53 in the clear: only the Analytics page tells you that;
• whether DNSSEC signature checking is working: it does not test it;
• what the applications outside the browser are doing, which on a phone is most of the traffic;
• what happens on the other devices on your network: it looks only at the one you run it from.

Almost always your IP address is not linked to the profile and the node refuses: that is the rule that stops us being a DNS open to anyone. Open the Linked IP page from that network and click Link This IP.

If you use plain DNS, look at the list of linked addresses: every night the ones that have not resolved for two days are removed, and linking a new one when the limit is full evicts an old one. Link it again. If instead it was your provider that changed your address, use the update link.

The site needs other domains too, for example the ones for images and videos: add those to the allowlist as well. And flush the DNS cache on the device, because the blocked answer can stay in memory for a few minutes.

Those devices use plain DNS from your network: the switch Allow DNS53 devices on the same network has to be on (Privacy page, Advanced Protections box) and your address has to be linked to the profile. That switch is on by default: if somebody turned it off, that is the cause.

Type the hostname only, with no https:// and no slashes. If the profile is in SECURE or QUANTUM mode you need the certificate, and with the hostname alone it will never work: use the app.

It has to be opened as administrator: right-click the Start button, Terminal (Administrator). If instead it answers with a credentials error, copy the command again from the Setup page, because it expires.

On an expired certificate the Generate Certificate button gives you back the old one. Use Renew Certificate: it creates the new one and leaves the old one valid a little longer, just long enough to replace it on your devices.

That is on purpose: for ads and trackers the domain simply does not exist, with no page, because a page for every banner would cost time on every load. The block page appears for the parental control categories, for dangerous sites, for the service categories, for your denylist and for blocked top-level domains.

The Dashboard is the first page after you sign in, and it sums up your account. From top to bottom you get:

• Query chart: the trend over the last 30 days, with the average, the peak and the blocking percentage. It adds up all your profiles.
• Coverage radar: how well you are covered on ads and trackers, threats, adult content and telemetry. It looks at the first profile, not the total.
• Your profiles: the first three, with name, code and the address to copy. The full list is on the Profiles page.
• Recent events: the last things that happened on your account, read at the moment you open the page. To refresh them, reload.
• Quick Actions: four shortcuts to the pages you use most.
• Node status: the three European servers that answer your queries.
• Posture: a summary of the protections turned on for your first profile.

They are four shortcuts to the pages you use most: Privacy, Denylist, Allowlist and Setup. Security and parental control have no entry of their own: they live inside the Privacy page.

Each profile shows:

• Name and Code: Profile identifier (e.g., prfxxxxxx)
• DoH URL: https://TUOCODICE.dns.albhosting.eu/dns-query
• The Dashboard shows the DoH address only. The addresses for DoT, DoQ, DoH3 and DNS53 are on the Setup page, Endpoints tab.

A profile is a configuration of its own, with its own blocking rules, its own allowlist and its own settings. Every profile has a different code, so you can keep one per situation:

• Home: With parental control enabled
• Work: Block social and streaming
• Mobile: Lightweight configuration
• Guests: Limited access

Up to five. There are no plans: the limit is the same for everybody and it is set by the administrator of the service.

The profile code (e.g. prfxxxxxx) identifies your profile inside the DNS addresses. In STANDARD mode it is also what authenticates your requests, so do not publish it. In SECURE and QUANTUM what authenticates you is the certificate installed on the device.

Yes. Duplicate makes a copy with the same rules and a new code: handy when you want to start from a setup you already like. Delete removes the profile, its rules and its certificate, and the devices that were using it stop resolving. The last profile you have left cannot be deleted: with no profile, the service would have nobody to answer.

On the Profiles page every row carries two signals: how long it has been since that profile resolved a query (green means recently, amber a while ago, red a long time ago or never) and how many devices are using it right now. If you have just set up a device and it stays at zero, the configuration did not reach its destination.

AEU DNS supports 5 protocols:

Yes, and it is the one we recommend. On the Setup page, for every system, there is a command you copy that does the whole job on its own:

• You copy the command, paste it into a command window opened as administrator, and it asks for the password of your AEU account.
• At the end the command checks by itself that DNS answers. If that check fails it puts the previous configuration back, so you are never left without internet.
• For every system there is also an uninstall command, which puts DNS back the way it was.
• The command expires quickly: if you copied it a while ago and it no longer works, open the Setup page again and copy a fresh one.

1. Open Settings, Network & Internet, Wi-Fi or Ethernet
2. Click your connection, then Edit DNS settings
3. Choose Manual
4. Turn IPv4 on
5. Preferred DNS: 85.235.151.21
6. DNS over HTTPS: On (manual template)
7. Template: https://TUOCODICE.dns.albhosting.eu/dns-query

1. Open Settings, Network & Internet, Private DNS
2. Choose Private DNS provider hostname
3. Enter: TUOCODICE.dns.albhosting.eu
4. Save

1. First link the public IP address of the router on the Linked IP page: without it, the router gets no answers
2. Sign in to the router panel
3. Go to the DNS settings
4. Enter our addresses, in this order (the second and the third are the spares):
   • 85.235.151.21 2a00:6d42:1242:1c00::7ee
   • 89.36.210.17 2a00:6d40:72:100::b0
   • 85.235.146.243 2a00:6d42:1242:2df3::1
5. If the router supports IPv6, add the long addresses above as well
6. Save and restart the router

On iPhone, iPad and Mac you install a configuration profile:

1. Download the profile from the Setup page
2. Open the downloaded file
3. On iPhone and iPad: Settings, General, VPN & Device Management
4. Install the AEU DNS profile

Linking your public IP address to the profile is what lets you use plain DNS on port 53. Without it the node refuses the request: that is the rule that stops us becoming a DNS open to anyone. It is needed for:

• Setting up a router that cannot speak DoH or DoT
• Making the protection work on devices that cannot encrypt their queries
• Protecting every device in the house in one move, through the router

1. Go to the Linked IP page
2. Click Link This IP
3. Your public address is associated with the profile you chose

If your provider changes your address, you have three routes:

• Manual update: Go back to the page and click Link This IP again
• Update link: Bookmark the special link on the page: opening it updates the address without signing in to the panel. If you regenerate the token, the old link stops working on every device
• API: The same link can be called from a script or from the router, up to 30 times an hour

Five is only the starting value: you choose the limit yourself, up to fifty. Two things happen without warning you, and they are worth knowing: if the limit is full and you link a new one, the oldest is removed; and if you lower the limit, the addresses over it are removed at once.

Three reasons, and all three are silent. They are worth knowing, because the symptom is always the same: DNS stops working on that device.

• Two days of silence: every night, the addresses that have not made a single query for two days are removed. An address linked "for later" and never used does not stay.
• Limit full: if you link a new address when the limit is full, the least recently used one is removed.
• Limit lowered: if you take the limit from ten down to three, the seven extra addresses are removed straight away, not at some later point.

They are yours, added by the system. Here is how it works:

• When one of your devices connects for the first time over an encrypted channel (DoH, DoT or DoQ), its address is linked to the profile on its own, so plain DNS works straight away from the same network.
• An automatic link is written into your account activity, as IP Auto-Registered, and the address appears in the list on the Linked IP page. The notification on your devices goes out when you link an address yourself, not when the system links one for you.
• If you unlink an address by hand, it is not linked again automatically for a week: your decision wins over the automatic one.

It works on one profile at a time and on a period you choose: one day, seven, thirty or ninety. It shows four things:

• Four numbers: total queries, blocked queries with the percentage, resolved queries and devices connected right now.
• The trend chart, with the average for the period, the peak day and the blocking percentage.
• The devices connected right now, with the transport they are using and the fingerprint of their address.
• The detail tables (most requested domains, most blocked, reasons for the block), which appear only when there is data to show.

Because we do not keep it. The numbers you see are counters: how many queries, how many blocked, when. Which domain you asked for is not recorded, so there is no list to show you and none to hand to anybody else. It is a design choice, not a setting you can switch on.

They are the ones that resolved something in the last few minutes: the list is live, and if nobody is browsing at this moment it is empty. For each device you see the transport it is using and the fingerprint of its address, never the address. Do not mix it up with the list on the Linked IP page: that one is the history of the authorisations, this one is who is using the profile right now.

If the administrator turns it on for a profile, that profile can be used by one device at a time. The page shows who is holding it and since when, with a button to release it: useful when a device is left hanging and another one needs to get in. If it is not turned on for your profile, that panel does not appear at all.

There are three levels, and the level of a profile is shown on the Setup page and in Settings:

It blocks the domains already known to be dangerous. Today it covers:

• Domains that distribute malware
• Sites that imitate real services to steal credentials
• Domains registered very recently, which is the typical signature of throwaway scams
• Domains that mine cryptocurrency using your computer

Not every dangerous domain is already on a list. Four protections recognise them by their shape, and you turn them on or off from the Privacy page:

• Machine-generated names, typical of malicious programs that change address every day
• Domains that imitate a well-known site by changing one letter (typosquatting)
• Domains written with characters from different alphabets so they look like a name you know
• Answers that point at your home network, used to attack it from outside (DNS rebinding)

DNSSEC checks the signature on DNS answers, that is, it checks that the answer really comes from the owner of the domain and was not changed along the way. With us it is on and it fails closed: if the signature does not add up, the answer is not delivered to you. Better no answer at all than a fake one that sends you to a fake site.

Yes, one: the baseline list against advertising and tracking stays on even if you switch every category off. Everything else is your choice, from the Privacy page.

On the Privacy page, Domain Lists box, the lists are grouped by category and each category is switched on and off on its own. Next to each one the panel writes how many entries it holds, so the number you read there is always the real one. The families are:

• Ads and tracking: the domains that serve banners and the ones that follow what you do, inside apps as well
• Threats: domains that distribute malicious programs and sites that imitate real services to steal your credentials
• Adult content and gambling: two separate categories, switched on one by one
• Newly registered domains, services and device telemetry: the first are the typical signature of throwaway scams, the second are social, streaming and games, the third is the data devices send back to their makers

They are trackers that present themselves as domains of the site you are visiting, so they are not recognised. Example: instead of tracker.esempio-pubblicita.com, the site uses metrics.tuosito.com, which still leads to the same data collector. AEU DNS follows the redirection and blocks them anyway. The list covers the known cases of this technique, which are few but heavily used.

Yes, with one single switch: on the Privacy page the Device telemetry category turns on every brand we know, all together. You do not pick brand by brand. It covers, among others:

• Apple: iCloud analytics, Siri data, App Store tracking
• Windows: Microsoft telemetry, Cortana, OneDrive tracking
• Samsung: Samsung analytics, Bixby data
• Xiaomi: MIUI analytics, Mi services

It has no page of its own: it lives inside Privacy. It is not a single switch but a set of things you turn on separately, on the profile you choose:

• Adult content and gambling: two distinct categories, switched on one by one
• Service categories: social, streaming, games, messaging. You switch on the whole category, you cannot pick the single service
• Enforce SafeSearch: forces safe mode on the search engines. It is off by default; you turn it on in Privacy, Advanced Protections box
• YouTube Restricted: hides adult videos. This one is off by default too

You block the category, not the single service: switching a category on blocks everything it holds, switching it off lets it through. The examples below tell you what you find inside each one:

• Social Networks: TikTok, Instagram, Facebook, Snapchat, Twitter/X
• Video Streaming: YouTube, Netflix, Twitch, Disney+
• Gaming: Steam, Epic Games, Roblox, Fortnite
• Messaging: Telegram, WhatsApp, Discord

You can block a whole top-level domain, that is the last part of the address. The panel suggests the riskiest ones and you can add others by hand, writing them with the dot in front. Among the suggested ones:

• .xxx .adult .porn - Adult content
• .ru .cn - High-risk countries (optional)

It is a time slot, for each day of the week, in which some restrictions are suspended: for example social media free from 17:00 to 19:00. The clock follows the time zone you pick in the rule. Only the categories you tick in that rule are lifted, not everything.

Almost always because the site needs other domains in order to work: images, videos, players, which sit on different names and are still blocked. AEU DNS opens by itself the technical domains it recognises as belonging to the same brand as the domain you allowed, but it cannot guess them all. If it stays blank: add to the allowlist the other domains you can see the site using, and flush the DNS cache on the device (sometimes restarting the browser is enough). The old, blocked answer can stay in memory on YOUR device for a few minutes.

It depends on the category, and that is on purpose. For adult content, gambling, dangerous sites (malware and phishing), service categories, domains on your denylist and blocked top-level domains, the browser shows the AEU block page, which says which domain was blocked and why. For ads and trackers, instead, the domain simply does not exist: the browser or the app reports a resolution error, or just does not show that piece of the page. A block page for every banner would cost time and traffic on every single load.

It is your personal list of blocked domains, and it applies to the profile you are editing. A domain written here is blocked together with all of its sub-addresses. Only one thing beats it: if the same domain is also on your allowlist, the allowlist wins.

1. Go to the Denylist page and pick the profile
2. Type the domain (e.g. example.com)
3. Click Add

No, there is no need: by typing example.com you block everything underneath it as well. The *. wildcard is accepted but adds nothing. These are already blocked:

• www.example.com
• api.example.com
• cdn.example.com
• Any other subdomain

No: on this page you add and delete, one entry at a time. To change a domain, delete it and type it again. There is no list import, no search and no export.

It is your personal list of domains that must always work. A domain written here wins over your denylist and over every automatic list, including the categories you turned on. Use it with judgement: it is the strongest tool you have.

Use the Allowlist when:

• A legitimate site is blocked by mistake
• You need to access a service blocked by policies
• An app does not work because one of its domains is blocked

Yes. A domain goes through five levels, in this order. The first one that decides, decides for everybody:

1. Service allowlist

   A small list of domains that have to work for everyone, for example operating system updates. We keep it and it cannot be switched off.

2. Allowlist

   What you write here gets through, even if a category you turned on would block it.

3. Related domains

   When you allow a domain, the technical domains of the same brand that it needs in order to work are opened too. That is why sometimes more gets unblocked than you expected, and why sometimes a site stays blank until you allow its own domains as well.

4. Denylist

   Blocked, unless the same domain is also on your allowlist.

5. Automatic blocklists

   Blocked if it appears in a category you turned on.

The Settings page works on one profile at a time: you pick which one at the top. It holds six boxes:

• Profile name: to tell it apart from the others.
• Performance: three optional adjustments, among them Cache Boost. They are off by default; if you do not know whether you need them, leave them off.
• Advanced: the block page. Two entries are marked as not yet available and, while they are, they do nothing.
• Post-quantum security: the post-quantum key exchange, zero-knowledge sign-in, and the switch that lets the devices on your network use plain DNS.
• DNS Rewrites: point a name at an address you choose, handy for reaching a device at home with an easy name.
• Danger Zone: duplicate the profile, or delete it. Deletion is immediate and the devices that were using it stop resolving.

We do not record which domain you ask for. There is no switch, because there is no log to turn on or off.

Not here: they are on the Privacy page, which holds the lists by category, the Advanced Protections, top-level domain blocking and Recreation Time. Settings holds only the adjustments to the profile itself.

The certificate is the membership card of your profile: you install it on the device and the node recognises that it is you. It is needed in SECURE and QUANTUM mode. Three things to know:

• There is only one certificate, identical in every mode: there are no two different types.
• It is one per profile, not per device: the same file goes on all your devices, and if you revoke it you cut them all off together.
• There is nothing personal inside the certificate: not your name, not your email. It identifies the profile, not the person.

1. Go to the Certificates page
2. Pick the profile
3. Click Generate Certificate. If you already have one and it has expired, use Renew Certificate instead: Generate would give you back the old one.
4. Download the format you need: there are six (PKCS12 file, profile for iPhone and iPad, script for Windows, script for Linux, file for Android, profile for Mac).
5. The password of the file is shown once only. If you lose it, it is not a disaster: download the file again and a new one comes out.
6. The certificate lasts 365 days. Below 30 days the panel marks it as expiring: renew it.

They are the two operations that matter, and they do opposite things:

• Renew Certificate creates the new certificate and leaves the old one valid for a while longer (normally two days), so you have time to replace it on every device without losing DNS.
• Revoke Certificate invalidates the certificate at once: every device using it stops resolving within a few minutes. It is the thing to do if you lose a device.
• There are two usage limits, so the service does not get hurt: 10 certificate operations per hour and 200 downloads per hour.

In the file you download, and also on our server, where it stays encrypted. That is why you can download the certificate again whenever you need it without regenerating it, and we would rather tell you than let you find out. If that does not suit you, revoke the certificate: it disappears from our side too.

It is about the key exchange of the session, not about the contents of the certificate:

• The key exchange

  When your program knows how to offer it, a post-quantum key is placed alongside the classic one

• Why it matters

  It protects against anyone recording the traffic today to try to decrypt it many years from now

1. Go to the My Account page
2. Enter your current password
3. Enter the new password (minimum 12 characters)
4. Confirm and save

1. Go to My Account, security box
2. Click Enable Now
3. Scan the QR code with an authenticator app (for example Google Authenticator, 2FAS or Authy)
4. Enter the 6-digit code to confirm
5. Save the backup codes BEFORE you close: they are shown once only, there is no button to download them again, and if you reload the page you lose them. If you do lose them you can regenerate them from your account, and the old ones stop working.

The AEU-ID (in the form AEU-XXXXXX) is your identifier in the AEU DNS system. You find it on the My Account page and it is what you quote when you write to support: with that we find you at once, without asking you for anything else.

There is no page in the panel for creating API keys. What can be automated without keys is this:

• The update of the linked address, with the special link on the Linked IP page: it can be called from a script, from a router or from a scheduled task.
• The app for Android, iPhone and iPad does the same things as the panel and is fine for everyday use.
• The program for the computer installs and uninstalls with a single command, which you find on the Setup page.
• If you regenerate the token of the update link, the old one stops working everywhere you had put it.

They are two entries on the My Account page, and they behave very differently:

• Export Your Data: the file arrives in your browser straight away and an email arrives with the same content attached. If you do not want that email in your mailbox, remember it before you press.
• Delete Account: it is immediate and cannot be undone. Profiles, rules, certificates and linked addresses are removed from the nodes as well, and your devices stop resolving.
• Activity logging: an anonymised trace stays behind, which we need for the security of the service and which can no longer be traced back to you.

The theme stays in the browser you are using: sign in from another computer and you get the starting one back. The language, instead, belongs to the account, and it also decides which language we write our emails to you in. The list of open sessions, with the option to close them remotely, can currently be seen in the phone app: it is not in the web panel yet.

Yes, AEU DNS is free for personal use. There are no paid plans: what you see in the panel is all there is, for everybody.

The AEU DNS servers are in Europe. In the profile settings you can turn on Cache Boost, which is off by default: it makes the answers quicker for the domains you visit often.

Absolutely yes. AEU DNS:

• It never sells your data to anyone
• It keeps no record of the domains you ask for: there is no list of your visits to hand to anybody
• It encrypts your requests with DoH, DoT, DoQ or DoH3. The plain route on port 53, reserved for the devices on your own network, travels unencrypted, and you can switch it off in the profile settings
• It adds the post-quantum key when your program knows how to offer it
• The servers are in Europe and the service is built for the GDPR

As many as you like: the same profile works on all your devices at once, and the rules apply to all of them. Only two limits, and both are visible: the number of linked addresses for plain DNS (you choose it, up to fifty) and, if the administrator turned it on for that profile, the one-device-at-a-time lock, which you can see on the Analytics page.

For technical support write to:

support@aeu-dns.com