Settings

The Settings page holds the profile’s behaviour. Save applies it to every PoP (and enrolled node) within seconds.

Settings that do not apply here

Not every opdns deployment can offer every setting. The page asks the API what this one supports (GET /v1/capabilities, computed from the server’s configuration, the same for every account) and draws itself from the answer:

• a setting the deployment leaves out is hidden;
• a setting it cannot offer is shown disabled, with the reason under it;
• one value of a setting it cannot offer (such as the block page below) is disabled with its reason, and the other values stay available.

Today the only such value is the Block page block mode: it needs the block page host, which is not deployed yet, so the option is shown disabled with that reason; the block page host is planned. Once the host runs, the API is started with OPDNS_BLOCK_PAGE=true and the option becomes available with no dashboard release.

Separately, a few options depend on the profile rather than the deployment, and say so in place: the node log destinations need an enrolled node (below), and the log options do not apply while logs are off. If the API does not answer the capabilities request, the page falls back to what it knows (every setting, the block page unavailable); the API still checks every change you save.

Block mode

What a device receives for a blocked query:

Mode	Answer	Notes
NXDOMAIN (default)	the name does not exist	apps give up fast; recommended
Null address	0.0.0.0 for A, :: for AAAA	some apps retry less
REFUSED	the resolver refuses	some devices then try another resolver, which may bypass filtering
Block page	the address of a page explaining the block	planned; not available yet, so the option is shown disabled with that reason

Every block, whatever the mode, carries an Extended DNS Error with the reason. See Block answers.

Logs

Changes apply to queries from now on; stored logs are not rewritten.

Switch	Off means	Applied
Keep query logs	no per-query record; the PoP keeps only an hourly count of the profile’s queries by outcome	on the PoP, before anything leaves it
Log client IP addresses	the client address is removed from the record	on the PoP
Log domain names	the name asked for, the answer addresses and rule text are blanked; time, device, outcome and list name are kept	on the PoP, and again at ingest

All three act on the PoP that answered, before the record leaves the machine; the log stream and the log database never see what you switched off. On a self-hosted node the same switches apply before the node writes its SQLite file. See Architecture and the log model for the whole path.

With Keep query logs off, or the destination set to Nowhere, the client IP and domain switches and the retention are greyed out, each with a note that it does not apply while logs are off (or stored nowhere). Their values are kept for when you turn logs back on.

Counters

Whatever these switches say, the cloud keeps hourly totals per profile (allowed, blocked, rewritten, error), with no names and no addresses, for 400 days. They are what Analytics shows as Totals and Queries over time when no per-query records exist: with logs off, with the destination set to Nowhere or My self-hosted node, and for queries blocked by an operator CSAM entry, which are never logged. Counters cover whole hours, so a range shorter than an hour shows the hour around it.

Log destination

Where records are stored:

Destination	Stored
opdns cloud	in opdns’s log database, for your retention
My self-hosted node	queued for your enrolled node (up to 7 days), stored in its SQLite file, not in the cloud database
Both	both
Nowhere	discarded at ingest

My self-hosted node and Both need a node enrolled on this profile. Until there is one, both options are disabled with a note and an Enrol a node link to Nodes (a profile already set to one of them keeps it). Once a node is enrolled, the options name it, and say that results the dashboard reads from the node are relayed through the cloud, encrypted in transit with TLS.

Queries your devices send to your node are logged only on the node, whatever this setting says. The destination governs what happens to queries sent to the cloud. See Logs on your node.

Storage region

Where the cloud keeps this profile’s logs (destination opdns cloud or Both). Canada is the only region today and the default: logs are stored in Québec, in OVH’s Beauharnois data centre. EU is shown with a Coming soon tag and cannot be chosen yet; the API refuses it (422, settings.log_region: region eu is not available yet). Once EU storage exists you will be able to move a profile’s logs there. Logs on your self-hosted node stay on the node whatever this says. API field: log_region (ca; eu announced).

Retention

1 day to 3 months (90 days): the menu offers 1 day, 7 days, 30 days and 3 months, and the API accepts any whole number of days from 1 to 90. Each record stored in the cloud gets an expiry when it is stored and is deleted after it; 90 days is the longest opdns keeps a query log. On a self-hosted node, the node’s own pruning applies the same setting to its SQLite file (Logs on your node).

Resolution

Setting	Effect
CNAME uncloaking	the names a CNAME answer points to are checked against your policy too, catching trackers disguised as a first-party subdomain
Cache boost (seconds)	minimum TTL on answers sent to devices, 0 to 86,400. 0 keeps each record’s TTL. Only the answer to the device changes; the resolver’s cache is not affected
EDNS Client Subnet	how much of your network’s address authoritative servers see; below

EDNS Client Subnet

EDNS Client Subnet (ECS, RFC 7871) lets the resolver tell authoritative DNS servers roughly where a query comes from, so a content network can answer with a server near you. The price is that those servers, which are run by third parties, see part of your address.

Mode	What authoritative servers receive
Off (default)	nothing about your network, so content networks answer for the location of the PoP
Anonymised	your network, truncated to /24 for IPv4 and /56 for IPv6
Full	your IP address itself: by default the complete address, though the operator may limit IPv6 to /64. It goes to every authoritative server queried on your behalf, and those operators may log it. Choose it only if more precise steering is worth that disclosure

In every mode:

• private-network and loopback addresses are never sent;
• if a device sends its own ECS option, it is never forwarded longer than your mode allows, and a device’s own opt-out (a /0 prefix) is always honoured;
• queries that identify no profile (the public path) never carry ECS;
• a device that sent ECS gets its option back with the prefix length the answer is valid for, as RFC 7871 requires.

The wording above is the privacy policy’s addendum of 2026-09-29.

Where it applies

Forwarding ECS needs Unbound’s subnet cache, which the PoP deployment switches on (the resolver job’s unbound_ecs setting, on by default since 2026-09-30). A PoP deployed without it sends no client subnet, whatever this setting says, which is the same as Off. Self-hosted nodes never forward ECS: your node is already next to you.