Basic Tutorial

• 1: What is DNS
• 2: NullPrivate Fundamentals
• 3: How DNS Affects Your Internet Experience
• 4: Home Setup

1 - What is DNS

Essentially, the DNS service is like a Xinhua Dictionary. By querying this dictionary, we can find the IP address corresponding to a domain name.

Introduction to DNS

DNS (Domain Name System) is one of the fundamental infrastructures of the internet. Like a Xinhua Dictionary, it is responsible for translating human-readable domain names into computer-understandable IP addresses.

How DNS Works

When you enter a website address in your browser:

1. The browser first checks local cache
2. If not found, it queries a DNS server
3. The DNS server returns the corresponding IP address
4. The browser uses this IP address to access the target website

Key Concepts

• Domain Name: A human-readable website address, such as www.nullprivate.com
• URL (Uniform Resource Locator): A complete web address containing protocol, domain name, and path, such as https://www.nullprivate.com
• IP Address: A numeric identifier for network devices, such as 1.1.1.1
• DNS Server: Computers that provide domain name resolution services
• Web Hosting: Storing website files on servers to make them accessible via the internet

2 - NullPrivate Fundamentals

Overview of How It Works

NullPrivate protects your network security and privacy through DNS-level interception. It acts like an intelligent gatekeeper, screening all domain requests:

• ✅ Safe websites: Normal access
• ❌ Ad domains: Blocked
• ❌ Trackers: Blocked
• ❌ Malicious websites: Blocked

Interception Flow Diagram

Key Features

1. DNS-Level Blocking: Intercepts before requests occur, more efficient
2. No Plugin Installation Required: Network-level protection effective for all devices
3. Low Resource Consumption: Only processes DNS requests, minimal impact on device performance
4. Full Device Coverage: Configure once, protect all connected devices

3 - How DNS Affects Your Internet Experience

How DNS Affects Your Internet Experience

When we open a webpage, stream a video, or click an in-app link, the first hop almost always lands on DNS. It acts like a phonebook for the internet world, translating human-friendly domain names into machine-understandable IP addresses. Many people attribute “slow webpages, inability to open, intermittent issues” to “poor network speed,” but a significant portion of experience fluctuations relate to DNS resolution success rate, latency, cache hit rate, and privacy policies. Understanding how DNS works, its exposure points in the network chain, and available protection strategies can help us break down “slowness and instability” into controllable factors.

Background and Problem Overview

DNS is the entry point for almost all network requests. Resolving a domain name typically takes only tens of milliseconds, but these milliseconds determine which server subsequent connections will point to, whether CDN nodes are hit nearby, and whether they will be hijacked by ISPs or observed by certain intermediate nodes. The experience differences between home, cellular, and public Wi-Fi networks often stem from variations in resolver cache quality, packet loss rates, and policy differences among resolvers. This article targets ordinary netizens, using continuous narrative to explain the relationship between DNS and internet experience, focusing on principles and trade-offs rather than specific deployment steps or evaluation conclusions.

Basics and Terminology

After a browser or application initiates a resolution request, it typically first queries the system’s local resolver, which then recursively queries root, TLD, and authoritative servers layer by layer, ultimately obtaining an answer with TTL. If local or network-side cache hits, external queries can be skipped, significantly reducing latency; if cache misses or expires, the full recursive process must be completed. The following diagram uses a simplified flow to show the resolution path, with animations emphasizing data flow rather than actual timing sequence.

flowchart TB
  C[Client] e1@--> L[Local Resolver]
  L e2@--> R[Recursive Resolver]
  R e3@--> Root[Root Server]
  Root e3r@--> R
  R e4@--> TLD[TLD Server]
  TLD e4r@--> R
  R e5@--> Auth[Authoritative Server]
  Auth e5r@--> R
  R e6@--> L
  L e7@--> C

  %% Fill color settings
  style C fill:#e1f5fe,stroke:#01579b,stroke-width:2px
  style L fill:#e8f5e8,stroke:#1b5e20,stroke-width:2px
  style R fill:#fff3e0,stroke:#e65100,stroke-width:2px
  style Root fill:#f3e5f5,stroke:#4a148c,stroke-width:2px
  style TLD fill:#fce4ec,stroke:#880e4f,stroke-width:2px
  style Auth fill:#e0f2f1,stroke:#004d40,stroke-width:2px

  %% Animation rhythm settings (Mermaid v11)
  e1@{ animation: fast }
  e2@{ animation: slow }
  e3@{ animation: slow }
  e3r@{ animation: slow }
  e4@{ animation: slow }
  e4r@{ animation: slow }
  e5@{ animation: fast }
  e5r@{ animation: fast }
  e6@{ animation: slow }
  e7@{ animation: fast }

TTL is the “shelf life” of each record. Within the TTL validity period, recursive resolvers can directly return cached answers to clients, contributing more to the perception of “speed and stability” than we intuitively estimate. On the other hand, how resolvers handle parallel IPv4 and IPv6 requests, whether ECS extensions are enabled, and whether negative caching is implemented for failed queries can indirectly affect your connection direction and first-packet time.

Privacy Threats and Motivations

Traditional plaintext DNS exposes metadata about “which domain you want to access” on the network path. This information leaves traces at local networks, access ISPs, and public resolvers, even if content is encrypted via HTTPS. For ordinary users, risks come more from “passive observation and profiling” than direct content leakage: long-term query sequences can infer your interests, lifestyle patterns, and device types. Scenarios like public Wi-Fi, shared hotspots, and international roaming involve more observable points on the path, with more common fluctuations and failures.

flowchart TB
  C[Client] e1@--> Net[Local Network & Router]
  Net e2@--> ISP[Access ISP Network]
  ISP e3@--> Res[Public Recursive Resolver]
  Res e4@--> Auth[Authoritative Server]

  %% Fill color settings
  style C fill:#e1f5fe,stroke:#01579b,stroke-width:2px
  style Net fill:#ffe8e8,stroke:#cc0000,stroke-width:2px
  style ISP fill:#ffe8e8,stroke:#cc0000,stroke-width:2px
  style Res fill:#ffe8e8,stroke:#cc0000,stroke-width:2px
  style Auth fill:#ffe8e8,stroke:#cc0000,stroke-width:2px

  %% Exposure point highlighting
  classDef risk fill:#ffe8e8,stroke:#cc0000,stroke-width:2px,color:#000
  class Net,ISP,Res,Auth risk

  %% Animation
  e1@{ animation: fast }
  e2@{ animation: slow }
  e3@{ animation: slow }
  e4@{ animation: fast }

It’s important to emphasize that privacy protection doesn’t necessarily equate to “faster.” Encryption and encapsulation introduce handshakes and negotiations, but high-quality recursive resolvers may actually be faster through better cache hits and lower packet loss. Real-world experience quality depends on the combined effects of your network, resolver quality, and target site deployment.

Protection Strategies and Principles

Encrypted DNS wraps “which domain you’re asking about” into encrypted tunnels, reducing opportunities for eavesdropping and tampering. Common methods include TLS-based DoT, HTTPS-based DoH, and QUIC-based DoQ. They all reuse mature transport layer security mechanisms, with differences mainly in ports and multiplexing models. Regardless of the method, clients typically still initiate queries to the local resolver stack first, then use encrypted tunnels to send requests to upstream resolvers. The following diagram illustrates this encapsulation and return process.

flowchart LR
  U[Client] e1@--> S[DoH Stack]
  S e2@--> R[DoH Server]
  R e3@-->|200 OK + DNS Response| S
  S e4@--> U

  %% Fill color settings
  style U fill:#e1f5fe,stroke:#01579b,stroke-width:2px
  style S fill:#e8f5e8,stroke:#1b5e20,stroke-width:2px
  style R fill:#fff3e0,stroke:#e65100,stroke-width:2px

  e1@{ animation: fast }
  e2@{ animation: slow }
  e3@{ animation: fast }
  e4@{ animation: fast }

Beyond encryption, resolver-side QNAME minimization reduces query granularity exposed to upstream, DNSSEC provides record integrity verification, and ECS controls CDN proximity and hit rates. For end users, the actual perceptible differences are “whether it’s more stable,” “whether it’s easier to hit nearby nodes,” and “whether there’s less hijacking.”

Implementation Path and Considerations

From a user perspective, systems and routers often have built-in resolvers or forwarders, and many public services offer built-in DoH switches at the mobile OS and browser levels. Choosing a trustworthy recursive resolver and appropriate encryption method usually covers most needs. Note that some enterprise or campus networks may have policy restrictions on encrypted DNS, and certain security products might intercept or redirect DNS traffic; in these environments, prioritize connectivity and compliance before considering privacy and performance. For overseas site access, the resolver’s geographical strategy and CDN deployment layout are equally important—incorrect proximity strategies may route you to transcontinental nodes, resulting in a “half-second lag” perception.

Risks and Migration

Any switch should preserve a rollback path. For personal devices, first enable encrypted DNS on a single device and observe for a week, paying attention to frequently problematic apps and sites. For home gateways, consider grayscale rollout to a few devices, keeping backup resolvers and enabling health checks when necessary. If the network has internal domains or split DNS, confirm compatibility of resolution scope and search domains before switching to avoid resolution failures and accidental leaks.

Scenario-based Recommendations

On cellular networks and public Wi-Fi, prioritizing stable public resolvers with DoH or DoT enabled often provides both more stable and cleaner resolution. For home broadband, cache hits and low packet loss are more important—quality public resolvers or local gateway caching can deliver the “instant open” smoothness. When accessing cross-border content, the resolver’s geographical strategy determines where you’ll be routed. If certain sites are “connectable but very slow,” try changing resolvers or disabling ECS. For families needing parental controls and traffic splitting, choosing resolvers with classification policies and transparent logging is more practical.

FAQ and References

Common questions include “Is encrypted DNS always faster?”, “Why do different resolvers return different IPs?”, and “Will changing resolvers affect security software?” There are no one-size-fits-all answers—they depend on link quality, resolver implementation, and site access policies. Further reading can refer to relevant IETF RFCs, mainstream browser and OS documentation, and trusted network infrastructure blogs.

4 - Home Setup

Setting Up NullPrivate at Home

NullPrivate is an enhanced fork of AdGuard Home, purpose-built for superior network-level ad blocking and privacy protection. This tutorial walks you through installing and configuring NullPrivate on your home network.

Project Overview

NullPrivate is an open-source fork of AdGuard Home that offers both SaaS hosting and a rich set of extra features, all aimed at delivering a better DNS resolution and network-filtering experience.

Key Features

Original Features

• Network-wide ad blocking: Block ads and trackers across the entire network
• Custom filtering rules: Add personalized blocklists and allowlists
• Encrypted DNS support: DNS-over-HTTPS, DNS-over-TLS, and DNSCrypt
• Built-in DHCP server: Ready-to-use DHCP functionality
• Per-client settings: Tailor settings for each individual device
• Parental controls: Block adult content and enforce Safe Search
• Cross-platform: Runs on Linux, macOS, Windows, and more
• Privacy-first: No usage analytics or telemetry

NullPrivate Add-ons

• DNS routing rule lists: Route DNS queries using rule lists in a config file
• App-level blocking rules: Target specific application sources
• Dynamic DNS (DDNS): Automatic hostname resolution updates
• Advanced rate limiting: Efficient traffic management and control
• Enhanced deployment: Load balancing, automatic certificate renewal, optimized connectivity

Installation Methods

Method 1: Download the Binary

1. Visit the Releases page and grab the binary for your OS.
2. Create a working directory:

   mkdir -p ./data
   

3. Launch NullPrivate:

   ./NullPrivate -c ./AdGuardHome.yaml -w ./data --web-addr 0.0.0.0:34020 --local-frontend --no-check-update --verbose
   

Method 2: Use Docker

Docker is the easiest and most portable way to deploy:

docker run --rm --name NullPrivate \
  -p 34020:80 \
  -v ./data/container/work:/opt/adguardhome/work \
  -v ./data/container/conf:/opt/adguardhome/conf \
  nullprivate/nullprivate:latest

Supported Platforms

• ✅ Windows
• ✅ macOS
• ✅ Linux
• ✅ Docker
• ✅ Other Unix-like systems

Configuration Guide

Initial Setup

After launch, open the web UI to finish configuration:

• Default admin URL: http://localhost:34020
• Create an admin account on first run
• Optionally import an existing AdGuard Home config

Configuration Files

The main file is AdGuardHome.yaml, which contains:

• DNS server settings
• Filtering rules
• Client definitions
• Security options

Command-Line Flags

Usage Tips

1. Network setup: Point your router’s DNS to the NullPrivate IP
2. Rule updates: Refresh blocklists periodically for best coverage
3. Performance monitoring: Check DNS query stats in the web UI
4. Security hardening: Enable HTTPS and use a strong password
5. Backups: Regularly back up the config file and data directory

Troubleshooting

Common Issues

• Port conflict: Make sure port 34020 is free
• Permission errors: Ensure correct file permissions on Linux
• Startup failure: Verify the config path and working directory exist

Getting Help

• Read the official docs
• Open an issue on GitHub Issues

Wrap-up

You should now have a working NullPrivate instance at home, giving you a cleaner, more private internet experience. NullPrivate’s rich feature set and flexible configuration options make it easy to tailor the service to your exact needs.