Public DNS resolver · Whalebone, s.r.o.
DNS4EU DNS servers
DNS4EU (run by Whalebone, s.r.o.) answers on 86.54.11.1 and 86.54.11.201, with DNS over HTTPS at https://protective.joindns4.eu/dns-query. In our 2026-09-24 test it validated DNSSEC and sent no client subnet.
- Addresses
- 20
- Variants
- 5
- Measured
- 2026-09-24
- Operator
- Whalebone, s.r.o.
- Primary IPv4
- 86.54.11.1
- All IPv4
- 86.54.11.1, 86.54.11.201, 86.54.11.12, 86.54.11.212, 86.54.11.13, 86.54.11.213, 86.54.11.11, 86.54.11.211, 86.54.11.100, 86.54.11.200
- All IPv6
- 2a13:1001::86:54:11:1, 2a13:1001::86:54:11:201, 2a13:1001::86:54:11:12, 2a13:1001::86:54:11:212, 2a13:1001::86:54:11:13, 2a13:1001::86:54:11:213, 2a13:1001::86:54:11:11, 2a13:1001::86:54:11:211, 2a13:1001::86:54:11:100, 2a13:1001::86:54:11:200
- DNS over HTTPS
- https://protective.joindns4.eu/dns-query, https://child.joindns4.eu/dns-query, https://noads.joindns4.eu/dns-query, https://child-noads.joindns4.eu/dns-query, https://unfiltered.joindns4.eu/dns-query
- DNS over TLS
- protective.joindns4.eu, child.joindns4.eu, noads.joindns4.eu, child-noads.joindns4.eu, unfiltered.joindns4.eu
- Service variants
- 5 (Protective; Protective with child protection; Protective with ad blocking; Protective with child protection and ad blocking; Unfiltered)
- DNSSEC in our test
- Validates
- Client subnet (ECS)
- None sent
- Protocols
- DNS (53), DoT, DoH
- Jurisdiction (stated)
- Operated by Whalebone, s.r.o., Jezuitská 14/13, 602 00 Brno, Czech Republic
DNS4EU DNS addresses by variant
Set the IPv4 or IPv6 addresses as your DNS servers, or use an encrypted endpoint where one is listed.
| Variant | Filtering (operator description) | IPv4 | IPv6 | Encrypted |
|---|---|---|---|---|
| Protective | Malware, phishing and command-and-control domains | 86.54.11.186.54.11.201 | 2a13:1001::86:54:11:12a13:1001::86:54:11:201 | DoH https://protective.joindns4.eu/dns-queryDoT protective.joindns4.eu |
| Protective with child protection | Protective, plus content not appropriate for children | 86.54.11.1286.54.11.212 | 2a13:1001::86:54:11:122a13:1001::86:54:11:212 | DoH https://child.joindns4.eu/dns-queryDoT child.joindns4.eu |
| Protective with ad blocking | Protective, plus advertising and tracking domains | 86.54.11.1386.54.11.213 | 2a13:1001::86:54:11:132a13:1001::86:54:11:213 | DoH https://noads.joindns4.eu/dns-queryDoT noads.joindns4.eu |
| Protective with child protection and ad blocking | Protective, plus child protection and ad blocking | 86.54.11.1186.54.11.211 | 2a13:1001::86:54:11:112a13:1001::86:54:11:211 | DoH https://child-noads.joindns4.eu/dns-queryDoT child-noads.joindns4.eu |
| Unfiltered | None | 86.54.11.10086.54.11.200 | 2a13:1001::86:54:11:1002a13:1001::86:54:11:200 | DoH https://unfiltered.joindns4.eu/dns-queryDoT unfiltered.joindns4.eu |
What we observed
Measured 2026-09-24 from one vantage point, three rounds per address, majority result. Anycast resolvers can behave differently from other networks.
- DNSSEC validation
- Validates Returned SERVFAIL for dnssec-failed.org, rhybar.cz and badsig.go.dnscheck.tools on every address that answered, while resolving example.com.
- Client subnet (ECS)
- No client subnet reached the authoritative server from any address we probed.
- Plain DNS and NXDOMAIN
- 10/10 documented IPv4 addresses answered on port 53. Random non-existent names came back as NXDOMAIN, so errors are not rewritten into ads or search pages.
| Protocol | Endpoint | Our test query |
|---|---|---|
| DoH | https://protective.joindns4.eu/dns-query | Answered |
| DoH | https://child.joindns4.eu/dns-query | Answered |
| DoH | https://noads.joindns4.eu/dns-query | Answered |
| DoH | https://child-noads.joindns4.eu/dns-query | Answered |
| DoH | https://unfiltered.joindns4.eu/dns-query | Answered |
| DoT | protective.joindns4.eu | Answered |
| DoT | child.joindns4.eu | Answered |
| DoT | noads.joindns4.eu | Answered |
| DoT | child-noads.joindns4.eu | Answered |
| DoT | unfiltered.joindns4.eu | Answered |
Which networks carry it
The announcing network comes from RIPEstat routing data for each documented address. The query network is where the resolver sent its own lookups during our probe, which a DNS leak test reports.
| ASN | Holder | Role |
|---|---|---|
| AS198121 | DNS4EU Whalebone, s.r.o. | Announces the service addresses |
| AS60068 | CDN77 Datacamp Limited | Queried from, in our probe |
Operator statements
Quoted from the operator's pages and checked word for word. We have not audited these practices.
“Operated by Whalebone, s.r.o., Jezuitská 14/13, 602 00 Brno, Czech Republic”
“The client's IP address is fully anonymised before being logged directly onto the resolver.”
Confirm your device is using DNS4EU
Changing a DNS setting does not guarantee your lookups reach that resolver: a VPN, a browser's own secure DNS or a proxy can send them elsewhere. Our DNS leak test shows which resolvers actually received your queries.
# Which address did the resolver query from?
dig +short whoami.akamai.net @86.54.11.1
# Does it pass your subnet on (ECS)?
dig +short TXT o-o.myaddr.l.google.com @86.54.11.1
# Does it validate DNSSEC? SERVFAIL means yes
dig dnssec-failed.org @86.54.11.1Behind a proxy
With an HTTP proxy, or a client set to socks5h://, the proxy side resolves hostnames, so your own resolver setting does not apply to that traffic. With socks5:// in curl or Python requests, your device resolves names first. The SOCKS5 vs SOCKS5h guide shows how to check which one you have.
DNS4EU questions
- What are DNS4EU's DNS server addresses?
- Protective: 86.54.11.1, 86.54.11.201, 2a13:1001::86:54:11:1, 2a13:1001::86:54:11:201. Protective with child protection: 86.54.11.12, 86.54.11.212, 2a13:1001::86:54:11:12, 2a13:1001::86:54:11:212. Protective with ad blocking: 86.54.11.13, 86.54.11.213, 2a13:1001::86:54:11:13, 2a13:1001::86:54:11:213. Protective with child protection and ad blocking: 86.54.11.11, 86.54.11.211, 2a13:1001::86:54:11:11, 2a13:1001::86:54:11:211. Unfiltered: 86.54.11.100, 86.54.11.200, 2a13:1001::86:54:11:100, 2a13:1001::86:54:11:200.
- Does DNS4EU validate DNSSEC?
- Yes. On 2026-09-24 every DNS4EU address that answered returned SERVFAIL for three deliberately mis-signed domains while resolving ordinary names.
- Does DNS4EU support DNS over HTTPS or DNS over TLS?
- DoH: https://protective.joindns4.eu/dns-query, https://child.joindns4.eu/dns-query, https://noads.joindns4.eu/dns-query, https://child-noads.joindns4.eu/dns-query, https://unfiltered.joindns4.eu/dns-query. DoT: protective.joindns4.eu, child.joindns4.eu, noads.joindns4.eu, child-noads.joindns4.eu, unfiltered.joindns4.eu. 10 of 10 answered our test query on 2026-09-24.
- Does DNS4EU send my IP subnet to other servers (ECS)?
- We observed no client subnet on any address we probed.
- How can I check that I am using DNS4EU?
- Run a DNS leak test and compare the network it reports with the one DNS4EU queried from in our probe (AS60068). On the command line, dig +short whoami.akamai.net @86.54.11.1 returns the address the resolver used to query Akamai.
Sources
Documentation checked 2026-09-24. Measured 2026-09-24. Registry reviewed 2026-09-24.
Addresses and endpoints come from each operator's documentation; behaviour is what we measured from one location on 2026-09-24. Speed, uptime and how well a filter blocks what it promises were not tested.