A DNS
that works
for you,
not on you.
Recursive DNS resolver with ad-blocking, tracker-blocking, malware filtering and a query log you actually own. Ten PoPs near you, control plane in Helsinki, no third parties, no upsell, no logs we can sell.
Fig. 1 — ten PoPs answering your DoH/DoT/DoQ queries from the closest one.
Defined by what we
refuse to ship.
Every "privacy DNS" startup of the last five years has flogged the same five claims: "blazing-fast anycast", "AI-powered", "zero-trust", "enterprise-grade", "military-grade encryption." We will not be doing any of that. Here is what we are doing instead.
/not selling logs
We make money from subscriptions. Period. Your query log is yours — you set retention, you delete it, you export it. There is no second business model where it ends up.
/not US-resident
Control plane is in Helsinki, EU. No US Cloud Act exposure for the data plane. If a US authority asks for your queries — they get the same answer your local cafe does: nothing, because we are not in their jurisdiction.
/not pretending to anycast
We have ten regional PoPs and route you to the closest one. That is geo-DNS, not anycast. Cloudflare has anycast. They also have your data. Pick your trade-off.
/not closed source
The edge resolver — the binary that actually answers your queries — is open source. Audit it. Self-host it. Compile your own and point your router at it. The brand is the trust; the code is just code.
Three steps.
No agents,no apps.
Set it on the router for your whole home, on your iPhone for travel, on your Mac for the office. Same endpoint. Same log. Same rules everywhere.
- Step 01
Sign up
Create an account. Get your unique config-id in your dashboard:
k7m2px9q. Pick which blocklists you want — ads, trackers, malware, parental. - Step 02
Point your device
On iOS / macOS / Pixel: paste
https://dns.vantagedns.com/k7m2px9q/dns-queryinto Private DNS settings. Or DoT:k7m2px9q-vantagedns.dns.vantagedns.com. On routers: same endpoints in DoH/DoT field. - Step 03
Watch the log
Every query lands in your dashboard within ~2 seconds. Block what you missed, allowlist false positives, switch profiles per device. Retention is your call: 24 hours by default, up to 30 days.
Open protocols.
No magic.
DoH (RFC 8484), DoT (RFC 7858), DoQ (RFC 9250) and plain DNS — pick whichever your client speaks. Here is what a query looks like, end-to-end.
# clean query — google.com goes through, normal answer
$ kdig @https://dns.vantagedns.com/k7m2px9q/dns-query +https google.com
;; ANSWER SECTION:
google.com. 300 IN A 142.250.190.78
;; Query time: 7 msec
;; SERVER: dns.vantagedns.com (helsinki)
# tracker — blocked, returned 0.0.0.0
$ kdig @https://dns.vantagedns.com/k7m2px9q/dns-query +https doubleclick.net
;; ANSWER SECTION:
doubleclick.net. 60 IN A 0.0.0.0
;; SERVER: dns.vantagedns.com (helsinki)
;; BLOCKED BY: oisd · category=trackers
# DoT alternative — same config-id, different transport
$ kdig @k7m2px9q-vantagedns.dns.vantagedns.com +tls google.com
;; SAME ANSWER. Different protocol. Your call. The datasheet,
not the brochure.
Numbers we are willing to defend. If any of these ever drift, you will see it on the status page before you see it in marketing.
| 01 | Edge points-of-presence | 10cities | EU · NA · APAC · LATAM · OCE |
| 02 | Transports supported | DoH·DoT·DoQ | + plain UDP/TCP for self-host |
| 03 | Mean query latency, EU, p99 | < 10ms | measured from monitor.lab |
| 04 | Recursive resolution, p99 (cache miss) | < 30ms | own resolver, not upstream proxy |
| 05 | Curated blocklists at launch | ~12lists | OISD, AdGuard, hagezi, ... |
| 06 | Custom blocklist / allowlist (paid) | ∞entries | on personal+ plans |
| 07 | Query log retention | 1–30days | you decide, not us |
| 08 | Control plane jurisdiction | EU / FI | no US Cloud Act exposure |
| 09 | Edge resolver source | open | audit · self-host · contribute |
| 10 | Vendor lock-in | zero | switch DNS in 30 seconds |
Switch DNS.
In abouttwo minutes.
Closed beta opens June 2026. Drop your email — we will write back from Helsinki, not from a CRM template.