How ODoH works
Think of it as sending a sealed envelope through a courier who cannot read it. Two independent parties each see half the picture, and only half:
Your device encrypts the query
Your DNS query is encrypted specifically for our resolver — the relay in the middle cannot read it, only pass it along.
The relay forwards it, blind
The relay sees your IP address (it has to, to route the connection) but the query inside is opaque to it — just encrypted bytes.
Our resolver answers, blind to you
Our resolver decrypts and answers the query, but it only ever sees the relay's address — never yours. It cannot tell which end-user asked.
Nobody can match the two
The relay never sees the query. The resolver never sees the identity. Without collusion between two separate operators, identity and query can never be joined.
Privacy by design, not by promise
No log to leak
AEU DNS cannot hand over a link between your IP and your queries — the architecture never creates that link in the first place.
Works over standard DoH
ODoH rides on top of the same DNS-over-HTTPS transport already used for encrypted lookups, so no extra client software is required.
Independent relay
The relay is a separate hop from the resolver, so a single operator being compelled or breached cannot reconstruct who asked what.
Free, opt-in transport
ODoH is included at no cost as one of AEU DNS's encrypted transports, alongside DoH, DoT, DoQ and DoH3.
Turn on Oblivious DoH in about two minutes
Create a free account, get your DNS profile and a personal certificate, and configure ODoH on any device.
Create your accountKeep exploring
New to encrypted DNS? Read how encrypted DNS works for a plain-language walk-through of how it protects you. You can also start from the AEU DNS home page, check our post-quantum DNS page for future-proof encryption, or see how AEU DNS handles GDPR compliance.
Frequently asked questions
What is Oblivious DoH?
Oblivious DoH (ODoH) is an encrypted DNS transport that adds a relay between your device and the resolver. The relay sees who you are but not your query; the resolver sees your query but not who you are. It splits identity from lookup on purpose.
Can AEU DNS link me to my queries?
No. With ODoH, our resolver only ever sees the relay's address, never yours. We never receive both your IP and your query in the same request, so there is nothing to link — even if we wanted to.
Who runs the relay?
The relay is a hop independent from the resolver. Because the two roles are separated, no single party — including AEU — holds both halves of the picture needed to identify who asked what.
Does it slow things down?
ODoH adds one extra encrypted hop, so there is a small latency cost compared to plain DoH — typically a few milliseconds. Most users won't notice it, and you can switch back to standard DoH/DoT/DoQ any time.
Do I need special software to use it?
No. ODoH rides on the same DNS-over-HTTPS transport already used for encrypted DNS, so any ODoH-aware client can use it. Create a free AEU DNS account and enable it on the Setup page.