ODoH Relay: Privacy-focused DNS relay without account requirements

What it does

ODoH Relay is a DNS privacy tool that implements the ODoH protocol (RFC 9230) to separate a user's IP address from their DNS queries. It runs as a single Rust binary that can operate in three modes: as a client that encrypts queries, as a relay that forwards encrypted traffic without seeing either the IP or the question, or as a target that handles actual DNS resolution.

The system splits DNS privacy across two independent operators. A relay sees the user's IP address but only receives encrypted queries. A target (like Cloudflare's resolver) sees the decrypted question but cannot identify where it came from. Neither operator alone can correlate IP address to DNS question.

Who it is for

The tool targets people running self-hosted DNS infrastructure like Pi-hole, AdGuard Home, or Unbound who want privacy without creating an account. It appeals to users who avoid commercial privacy DNS services due to account requirements or platform restrictions. The launch mentions the self-hosted audience specifically lacked an anonymous-DNS option without account or platform lock-in.

Pricing

The site does not show prices.

How it stands out

Every existing privacy-focused DNS service mentioned—Apple's iCloud Private Relay, NextDNS, Cloudflare for Families, Quad9—requires an account or telemetry collection. ODoH Relay requires no account and uses MIT licensing. It ships as a single binary with sensible defaults that work without configuration. The relay is the second public ODoH relay operator in the ecosystem; before this, only one well-known deployment existed.

The implementation prioritizes auditable cryptography rather than custom code. It uses established HPKE (RFC 9180) and TLS libraries rather than hand-rolled primitives. The builder published decisions about SSRF validation and design constraints.

What a founder should check

A rival should verify the competitive durability of account-free operations. If accounts generate switching costs and enable retention, can a service without accounts survive? Investigate whether users of self-hosted resolvers actually want this integration or prefer separate privacy tools. Finally, examine whether the protocol itself (ODoH/RFC 9230) will see adoption from other relay operators and targets—a single relay and target pair offers less privacy than a fragmented ecosystem with multiple independent operators.

Thinking of building something like this?

Every launch here is a competitor to somebody's idea. If yours is close, check it against the market before you build: the Full Check names the rivals, the prices and the gaps.