Nameservers At the registrar, set NS to: NSns1.goydns.com ns2.goydns.com ns1 and ns2 are two IPv4 addresses on this same machine so registrar forms that want two NS hosts can be filled. Glue for those names is on goydns.com.
DNSSECsigned Hosted domains are signed (ECDSAP256SHA256, NSEC3). Each domain page shows CDS to paste as DS at the parent. Until DS is in the parent, validating resolvers may SERVFAIL; most stub users still see the A record. For goydns.com itself, DS has to be added at the registrar (Namecheap Advanced DNS, add DS, not "enable DNSSEC" for BasicDNS).
Plain DNS UDP/TCP 53ns1.goydns.com / 51.68.46.72 UDP and TCP 53 ns2.goydns.com / 51.68.46.72 UDP and TCP 53
DNS-over-TLS (DoT) TLS on port 853. Use the nameserver name so the certificate matches: DoTtls://ns1.goydns.com tls://ns2.goydns.com Still hosted names only. Useful if your stub or forwarder can pin a TLS NS.
DNS-over-HTTPS (DoH) RFC 8484, GET or POST, application/dns-message: DoHhttps://goydns.com/dns-query Same answers as port 53, with no query logs and no session cookies. Queries for names we do not host are refused.
Oblivious DNS-over-HTTPS (ODoH) ODoH is a privacy protocol for recursive resolvers: a relay hides your IP from the resolver. GoyDNS answers hosted names only. We run no ODoH relay or proxy, and we will not add a public recursive resolver for it. A third-party ODoH relay may use our DoH URL as a target only for names we actually host. That hides the client's IP from us. Queries for names we do not host stay refused and nothing is logged.
Scope TransportWhereAnswers UDP/TCP 5351.68.46.72, 51.68.46.72Hosted names DoT853 / tls://ns1, tls://ns2Hosted names DoH/dns-queryHosted names ODoHThird-party relay, our DoH as targetHosted names; no relay here Hosted names only, with no family filter and no query logging. DNS cookies and response-rate limits reduce the value of the authoritative port for reflection attacks.
GoyDNS