Privacy

We do not log DNS queries, DoH questions, or DoT questions. There is no query log to export, no query log to subpoena, and no query log that can be switched on later. No analytics. No ads. No third-party scripts. Data is not sold. Profiles are not built.

NO LOG QNAME / DoH / DoT

Query logs None never collected

Email None token shown once

Ads None no third-party scripts

1. Scope

1.1This page states what GoyDNS keeps and what it does not. It covers GoyDNS only.

1.2GoyMail at shabbos.to is sister mail, same operators, a different product, a different policy.

2. No logs

2.1GoyDNS does not store DNS query logs. Who asked, from where, and for which name are not written down.

2.2That is true of every DNS transport we speak:

UDP and TCP port 53: no QNAME, QTYPE, or client IP history
DNS-over-TLS (port 853): no session log of names looked up
DNS-over-HTTPS (/dns-query): no log of DoH questions or answers

2.3Hosted names are answered and discarded. Names we do not host are refused and discarded.

2.4There is no archive. There is no "last 90 days." There is no resolver log to produce later. Asked for query logs or client IPs for DNS, the answer is that they do not exist. See Leo.

3. Data stored

3.1What is stored is what it takes to run an account and to answer hosted DNS.

3.2A hash of the account token. The token is shown once. It is not stored in the clear.

3.3Optional TOTP, encrypted, if enabled.

3.4Hashes of API keys and of session cookies.

3.5Which names an account owns, and the records published for those names.

3.6Plan, trial and paid-until, prepaid balance, and invoices: coin, amount, receive address, confirmation state.

3.7Whether a domain may appear in the public header.

3.8DNS records exist so the nameserver can answer them. They are the zone as edited. They are not a log of who queried that zone.

4. Uncollected

4.1Register asks for no email, no telephone, and no identity paper.

4.2No marketing lists. No advertising identifiers. No third-party analytics. Account data and zone data are not sold.

4.3No DNS query logs. No client IP history for DNS. No DoH log of names looked up. No recursive cache of other people's questions. The token is shown once. A hash is stored.

5. Payments

5.1Crypto only. No card numbers. No bank accounts. No KYC papers.

5.2An invoice keeps the receive address that was issued, the amount, the coin, and whether the chain confirmed it, so the account can be credited. Who paid is not asked.

5.3Donations are an amount toward the public funding total. They are not a hosting plan.

6. Operations

6.1The box keeps ordinary machine journals so it can be run: crashes, TLS issuance, unit restarts.

6.2Those journals are not DNS query logs. They stay unpublished. They cannot reconstruct who looked up a name. Query logs were never collected.

6.3Warrant canary: /canary.txt.

6.4The header may list a random sample of domains whose registrar NS is pointed here and whose Header toggle is on. Those links go through a confirm page. Header can be turned off on the domain.

7. Cookies

7.1Session cookies exist so domains can be managed in a browser. DNS, DoH, and DoT lookups do not set them.

7.2Clearnet: goydns_sid (HttpOnly) and goydns_csrf.

7.3Overlay: host-only, no Secure flag, no HSTS.

7.4DoH does not set session cookies.

7.5API and MCP use a Bearer key. They do not need cookies.

8. Sister service

8.1GoyMail at shabbos.to is sister mail, same operators, different accounts, different policy.

8.2This page covers GoyDNS only. Mailboxes are not imported into DNS. Zone data is not sent to GoyMail.

9. Legal

9.1We will fight legal claims as much as possible.

9.2Asked for query logs or client IPs for DNS, the answer is that they do not exist and cannot be produced. See Leo. Terms of use: Terms.

9.3The Operator does not cooperate with law enforcement. There is no duty to. See Leo.

GoyDNS