# TreeIQ Web Protection — encrypted-DNS (DoH) resolver hostnames.
# Blocking these makes browsers fall back to the system DNS, so Web Protection
# (adult/malware filtering + SafeSearch) can't be bypassed by DNS-over-HTTPS.
# use-application-dns.net is Firefox's canary: returning NXDOMAIN for it makes
# Firefox turn its default DoH OFF automatically.
use-application-dns.net
mozilla.cloudflare-dns.com
cloudflare-dns.com
chrome.cloudflare-dns.com
one.one.one.one
dns.google
dns.google.com
dns64.dns.google
doh.opendns.com
doh.familyshield.opendns.com
dns.quad9.net
dns9.quad9.net
dns10.quad9.net
dns11.quad9.net
dns.adguard.com
dns-family.adguard.com
dns.adguard-dns.com
family.adguard-dns.com
unfiltered.adguard-dns.com
doh.cleanbrowsing.org
doh.dns.sb
dns.nextdns.io
doh.nextdns.io
firefox.dns.nextdns.io
chromium.dns.nextdns.io
doh.dnswarden.com
doh.libredns.gr
doh.centraleu.pi-dns.com
odvr.nic.cz
dns.digitale-gesellschaft.ch
doh-de.blahdns.com
doh-jp.blahdns.com
dns.rubyfish.cn
doh.tiar.app
doh.crypto.sx
dns.controld.com
freedns.controld.com
