Run test

dns0.eu review: a European, GDPR-first resolver built for data sovereignty

An honest look at dns0.eu — a non-profit EU resolver that keeps queries under European law, strips EDNS Client Subnet, and ships three tiers for threat blocking, maximum privacy, and family-safe browsing.

Updated 8 min read

What is dns0.eu?

dns0.eu is a free public DNS resolver run by a European non-profit and built for EU data sovereignty. It operates from points of presence inside the EU, strips EDNS Client Subnet, anonymises data, validates responses with DNSSEC, and offers encrypted transport — with a default tier that also blocks malware and threat domains.

The framing matters more than it might sound: dns0.eu isn't pitched primarily as a speed play or an ad blocker. Its entire reason to exist is jurisdiction and privacy — keeping the record of what your devices look up handled under European data-protection rules rather than a commercial or foreign one.

Addresses and tiers

dns0.eu publishes three tiers, each on its own pair of IPv4 addresses plus IPv6, so you choose the behaviour you want simply by which address you point your device at. The default tier is the one most people should start with; ZERO and KIDS exist for two specific needs.

Default — malware & threat blocking + DNSSEC

Primary 193.110.81.0
Secondary 185.253.5.0

ZERO (max privacy)

Minimal filtering, maximum privacy (zero.dns0.eu).

Primary 193.110.81.9
Secondary 185.253.5.9

KIDS (family-safe)

Blocks adult content plus malware and threats (kids.dns0.eu).

Primary 193.110.81.1
Secondary 185.253.5.1

IPv6 (default tier)

Primary 2a0f:fc80::
Secondary 2a0f:fc81::

For encrypted DNS, dns0.eu's DNS-over-TLS hostname is dns0.eu, and each tier has its own hostname — zero.dns0.eu for ZERO and kids.dns0.eu for KIDS. DNS-over-HTTPS is available on the same hostnames, so any operating system or router that speaks DoT or DoH can talk to dns0.eu directly, with no plaintext queries leaving your device.

Data sovereignty: the whole point of dns0.eu

Every DNS query is a small record of intent — the domain you were about to visit, the moment you tried. dns0.eu's pitch is that this record should stay inside the EU and be governed by European data-protection law. It operates from points of presence in the EU, describes itself as a GDPR-compliant non-profit, and states that it anonymises data and never sells query data. Being a non-profit doesn't automatically make a privacy claim true, but it removes the commercial pull that leads ad-funded resolvers to retain and monetise query history. If your reason for leaving your ISP's DNS is jurisdiction rather than speed, that combination is exactly what dns0.eu is built to offer.

One concrete privacy choice backs this up: dns0.eu strips EDNS Client Subnet. Many resolvers forward a truncated version of your network address to authoritative servers so a CDN can route you to a nearby edge, which quietly shares roughly where you are with every site you visit. dns0.eu declines to do that by default. You may occasionally land on a slightly less optimal CDN edge as a result, but your rough location stays with the resolver instead of being broadcast onward — a deliberate privacy-over-locality trade that fits its ethos.

Security: what the default tier blocks

On the default address, dns0.eu checks the domains you look up against threat intelligence and refuses to resolve ones linked to malware, phishing, and similar abuse. When a domain is blocked your device never receives an address to connect to, so the connection fails before it starts — protection that covers every device pointed at the resolver, with nothing to install. It is a coarse but useful layer: it can't catch a threat that never triggers a DNS lookup, and like any blocklist it can occasionally flag a legitimate domain that was recently compromised or cleaned up. Alongside the blocking, DNSSEC validation stays on, so responses that were forged in transit are rejected rather than trusted.

The three tiers, and how to choose

dns0.eu keeps its options deliberately simple — three tiers rather than an account and a dashboard of toggles. The default tier (193.110.81.0) is the general-purpose choice: malware and threat blocking with DNSSEC, suitable for most home and small-office networks.

The ZERO tier (193.110.81.9) does the opposite of what a filtering service usually does: it applies minimal filtering so the resolver stays out of your way, prioritising privacy and unmodified answers. Reach for it if you run your own blocking upstream — a Pi-hole, say — or simply want the resolver to resolve and nothing more.

The KIDS tier (193.110.81.1) is the family-safe option, layering adult-content filtering on top of the threat blocking. Setting it on a router applies that filtering to every device on the network at once, which is usually where family filtering belongs. There is no ad or tracker blocking on any of the three tiers — dns0.eu stays scoped to security and privacy — so pair it with a dedicated resolver like AdGuard DNS if cutting ads is your main goal.

Who dns0.eu suits

dns0.eu is a strong fit if you are in or near Europe and want a resolver whose whole design is about keeping your DNS under EU law — a non-profit that strips EDNS Client Subnet, anonymises data, and gives you a clean choice between threat blocking, maximum privacy, and family filtering. It suits people who would otherwise reach for a privacy-first resolver such as Mullvad DNS but want built-in threat blocking as a default, or a European alternative to a Swiss non-profit like Quad9. It is a weaker choice if you connect from far outside Europe, where its EU-centric points of presence can add latency, or if ad blocking is the feature you actually care about.

Pros and cons

Pros

  • Run as a European non-profit with points of presence in the EU, so your DNS queries are handled under European data-protection law rather than a foreign jurisdiction — a meaningful distinction if data sovereignty is why you're switching in the first place.
  • Strips EDNS Client Subnet, so the approximate network location that reveals roughly where you are is not forwarded on to the authoritative servers your queries reach.
  • States that it anonymises data and never sells query data — the incentive that pushes many free resolvers toward retention simply isn't part of a non-profit's model.
  • Validates responses with DNSSEC, rejecting DNS records that were forged or tampered with in transit.
  • Encrypted transport is available through DNS-over-TLS and DNS-over-HTTPS, so queries never leave your device in plaintext.
  • Three ready-made tiers cover the common needs on separate addresses — threat blocking by default, maximum privacy with ZERO, or family-safe filtering with KIDS — and none of them require an account.

Cons

  • Its points of presence are EU-centric, so connecting from far outside Europe can mean a longer round trip than a resolver with an edge nearer you. Distance, not the software, is usually the deciding factor here — run the live test to see what it actually costs you.
  • It is carried as a reference resolver on this site: its DoH endpoint isn't verified for the permissive CORS headers the in-browser test needs, so no live latency figure is published for it (and none is ever invented).
  • The default tier's threat blocking is a blocklist, which means it can occasionally misfire on a legitimate-but-flagged domain and does nothing against a threat that never triggers a fresh DNS lookup.
  • No ad or tracker blocking on any tier — dns0.eu is scoped to security and privacy, and content filtering exists only on the KIDS tier, so it won't replace a dedicated ad-blocking resolver.

How to set up dns0.eu

Using dns0.eu means entering its addresses in your device's or router's network settings, replacing the DNS your ISP assigns automatically. Pick the tier you want first: use 193.110.81.0 and 185.253.5.0 for the default (threat-blocking) tier, or the matching pair from the ZERO or KIDS cards above. Use the IPv6 pair instead if your network prefers IPv6. Step-by-step instructions for each platform:

Setting it on your router applies dns0.eu — and whichever tier you chose — to every device that joins your network, which is usually the most effective place to configure it. For the strongest privacy, configure the encrypted DoT or DoH hostname rather than the plain IPv4 addresses where your platform supports it.

dns0.eu — questions

What is dns0.eu?

dns0.eu is a free public DNS resolver run by a European non-profit. It resolves domain names like any resolver, but is built specifically for EU data sovereignty: it operates from points of presence in the EU, strips EDNS Client Subnet, anonymises data, and validates responses with DNSSEC. Its default tier also blocks domains linked to malware and other threats.

Is dns0.eu GDPR-compliant, and where are its servers?

dns0.eu describes itself as an EU-based, GDPR-compliant non-profit with servers located in the EU, and states that it anonymises data and never sells query data. As with any resolver, you are trusting the operator's stated policy — read dns0.eu's own documentation for the full legal detail before you rely on it.

What is the difference between the default, ZERO, and KIDS tiers?

The default address blocks domains associated with malware and threats while keeping DNSSEC validation on. ZERO applies minimal filtering for people who want the resolver to get out of the way and maximise privacy. KIDS adds adult-content filtering on top of the threat blocking for family-safe browsing. Each tier is a separate address you point your device at — no account needed.

Is dns0.eu free to use?

Yes. All three public tiers are free to set on a computer, phone, console, or router. Because it strips EDNS Client Subnet and offers encrypted transport, it is often chosen by privacy-conscious users in Europe who want a resolver aligned with EU law rather than a commercial one.

Why isn't dns0.eu in the live browser speed test, and is it fast?

This site only publishes a browser latency number for resolvers whose DoH endpoint sends the CORS headers a browser needs to time it directly, and dns0.eu's isn't verified for that — so it is carried as a reference entry rather than measured live. Speed depends heavily on your distance from its EU points of presence; run the live DNS speed test from your connection to see how nearby resolvers compare, then set dns0.eu and judge your everyday page loads.