Tested clients

opdns keeps a test matrix of real DNS clients against the resolver, over every transport and every way of naming a profile. This page is its summary; the full table and the script are in the repository (docs/resolver/interop.md, deploy/dev/scripts/interop.sh).

Where this was tested

The command-line rows were run on 2026-09-30 against the local simulation (Unbound 1.26.1), not against the production service. The operating system and browser rows have not been run yet: they need real devices and a PoP they can reach.

How each cell is checked

Each check asks two names through the client: an allowed name, which must resolve, and a name on a list the test profile enables, which must get opdns’s block answer (NXDOMAIN with Extended DNS Error 17, Filtered). A check of the unfiltered public path must get the real answer instead. A client that shows neither the EDE nor the authority section can prove the transport works, not the filtering; the same transport and method are then covered by another client.

Command-line clients

Client	Plain DNS	DNS-over-TLS (profile in the server name)	DNS-over-QUIC (profile in the server name)	DNS-over-HTTPS (profile in the path)	DNS-over-HTTP/3
dig 9.20	works: linked IP over UDP and TCP, IPv6 profile address	works	not in the matrix	works (GET and POST)	not in the matrix
kdig 3.4	works: linked IP	works	works	works	not in the matrix
q 0.19.12	works: linked IP	works	public name only (1)	works	works
dnslookup 1.12.0	not in the matrix	works	works	works	works
doggo 1.4.0	works: linked IP	works	works	works	not in the matrix
curl 8.14 (--doh-url, --http3-only)	n/a	n/a	n/a	works, filtering not visible (3)	works
systemd-resolved style DoT (openssl s_client)	n/a	works	n/a	n/a	n/a
unbound-host 1.26.1 (Unbound as a forwarder)	linked IP works, filtering not visible (3)	works, filtering not visible	n/a	n/a	n/a

“Works” means the allowed name resolved and the listed name got the block answer. Where the matrix also ran the client against the public name (for dig, kdig, q, dnslookup, curl and openssl), it got unfiltered answers, as it should.

A trap: the profile in the DoH host name

DNS-over-HTTPS identifies the profile by the path, https://dns.opdns.net/<profile-id>, never by the host name. A client configured with https://<profile-id>.dns.opdns.net/dns-query reaches the unfiltered public path: it resolves, but nothing is filtered. The matrix checks this on purpose with every DoH client. Use the address from Your endpoints.

Known limitations

1. q with DNS-over-QUIC and a profile server name. q ignores --tls-server-name for quic:// and checks the certificate against the name it dials. With the profile name in the address it works where that name resolves (production has the wildcard record); in the simulation it does not resolve. kdig, dnslookup and doggo pass the same check.
2. dog has had no release since 2020 and has no DNS-over-QUIC; doggo covers the same ground and replaces it in the matrix.
3. curl and unbound-host show neither the EDE nor the authority section, so a filtered name and a public NXDOMAIN look the same to them. They prove the transport and the allowed name; filtering on the same transport is proven by dig, kdig or doggo.
4. systemd-resolved itself was not run: it needs systemd as PID 1, which the test container does not have. openssl s_client reproduces what it does with DNSOverTLS=yes and DNS=<address>#<name> (TLS to port 853, the server name and hostname check from the # name, length-prefixed messages), and passes.

Operating systems and browsers (not yet tested)

These follow the setup guides and are still to be run on real devices, checking the two names above and that the dashboard’s query log shows the device under the right profile.

Client	Transport	Setting	Status
iOS and macOS configuration profile	DNS-over-HTTPS	iOS, macOS	not yet run
iOS and macOS configuration profile	DNS-over-TLS	iOS, macOS	not yet run
Android Private DNS (Android 9 and later)	DNS-over-TLS	Android	not yet run
Windows 11	DNS-over-HTTPS	Windows	not yet run
Firefox	DNS-over-HTTPS	Firefox	not yet run
Chrome	DNS-over-HTTPS	Chrome	not yet run
systemd-resolved	DNS-over-TLS	Linux	not yet run
A router or any host	plain DNS, linked IPv4 or IPv6 profile address	Set up a network	covered by the command-line matrix

Things to watch on those rows: Android and Apple devices send the whole host name as the TLS server name, so the device prefix must survive; Windows 11 offers DNS-over-HTTPS only for addresses it has a template for, so the template is entered by hand; Chrome and Firefox fall back to the system resolver when DNS-over-HTTPS fails unless set to strict (Firefox Max Protection).