Configure Brave Browser for Secure DNSaaS

📋 Overview

Brave Browser includes built-in support for DNS-over-HTTPS (DoH) with custom providers. This guide will help you configure Brave to use our secure DNSaaS service with token-based authentication.

Service	Endpoint	Authentication
Primary DNS	`https://dns1.oss.co.za/xxxxx?dsn`	Token in URL path
Protocol	DNS-over-HTTPS (DoH) • Port 443 • TLS 1.3
Brave Version	Version 1.50+ (all recent versions)

✅ Verified Working This configuration has been tested and confirmed working with Brave Browser. The correct format uses ?dsn (not {?dns}).

🦁 Configure Brave Browser ✅ Working

1 Open Brave Settings

Click the Brave menu (three horizontal lines in the top-right corner) → select Settings.

Alternatively, type brave://settings/ in the address bar and press Enter.

2 Navigate to Privacy & Security

In the left sidebar, click Privacy and security → then click Security.

Alternatively, type brave://settings/security in the address bar.

3 Scroll to "Advanced" Section

Scroll down to the Advanced section.

Look for "Use secure DNS".

4 Enable Secure DNS

Toggle the switch to ON for "Use secure DNS".

Select "Add custom DNS service provider" from the dropdown menu.

💡 Important Select "Add custom DNS service provider" - this allows you to enter your token-gated endpoint.

5 Enter the Custom DoH Endpoint

Enter the following URL (replace token_testclient123 with your token):

✅ WORKING FORMAT - Verified with Brave
https://dns1.oss.co.za/testclient123?dsn

✅ This Format Works

The token is in the URL path: /token_testclient123
The ?dsn parameter tells Brave this is a DNS provider
No /dns-query suffix or {?dns} template needed
This format has been tested and verified with Brave

6 Save and Verify

The setting saves automatically. Brave will validate the endpoint and should accept it without errors.

✅ Success Indicator The endpoint should be accepted immediately. If you see the custom DNS provider listed with your URL, it's working.

🧪 Test Your Configuration

Use these test sites to verify your Brave configuration is working correctly.

Blocked Domains (Should NOT Load)

Test Domain	Expected Result	What You Should See
`http://zycdjz.com`	BLOCKED	"This site can't be reached" or DNS_PROBE_POSSIBLE
`http://malware.testcategory.com`	BLOCKED	"This site can't be reached" or DNS_PROBE_POSSIBLE
`http://phishing.testcategory.com`	BLOCKED	"This site can't be reached" or DNS_PROBE_POSSIBLE
`http://adult.filterdns.net`	BLOCKED	"This site can't be reached" or DNS_PROBE_POSSIBLE

Clean Domains (Should Load Normally)

Test Domain	Expected Result	What You Should See
`https://example.com`	LOAD	Normal page loads
`https://google.com`	LOAD	Normal page loads

DNS Leak Test

Test Domain	Expected Result	What You Should See
`https://dnsleaktest.com`	Your DNS Server	Should show `dns1.oss.co.za` or `102.220.218.218`

🔍 What Blocked vs Unblocked Looks Like

Here's how the same domain appears in different browsers:

❌ Firefox (NOT using Secure DNS) 503 Service Temporarily Unavailable (The site exists but is down)

✅ Brave (USING Secure DNS) DNS_PROBE_POSSIBLE "This site can't be reached"

✅ The Difference is Clear

When NOT using secure DNS: You see 503 Service Temporarily Unavailable
When USING secure DNS: You see DNS_PROBE_POSSIBLE - the domain is blocked!
This proves your filtering is working correctly

🔧 Troubleshooting

❌ "Please verify that this is a valid provider"

Make sure you're using the correct format: https://dns1.oss.co.za/xxxxx?dsn
Not {?dns} - Brave accepts ?dsn
Check that your token is valid and active
Verify network connectivity to dns1.oss.co.za

❌ Domains still loading when they should be blocked

Clear the DNS cache: brave://net-internals/#dns → Clear host cache
Check that the token is correct and active
Verify the custom blocklist is loaded: /etc/powerdns/siteslist.rpz
Restart Brave after making changes

✅ Verify It's Working

Visit http://adult.filterdns.net - should show "This site can't be reached"
Visit https://dnsleaktest.com - should show dns1.oss.co.za
Visit brave://net-internals/#dns and check for DNS-over-HTTPS queries

↩️ How to Roll Back

To revert to your previous DNS settings:

Step 1: Go to Security Settings

brave://settings/security

Step 2: Turn Off Secure DNS

Toggle the "Use secure DNS" switch to OFF.

Alternatively, select "With your current service provider" from the dropdown.

Step 3: Clear DNS Cache

Visit brave://net-internals/#dns and click "Clear host cache".

🎯 Summary

🦁 Brave Browser supports DoH natively in Settings
✅ Working URL: https://dns1.oss.co.za/xxxxx?dsn
🔒 All DNS queries are encrypted via DoH (port 443) with TLS 1.3
⚡ The ?dsn parameter is required - not {?dns}
🔄 Easily toggle on/off as needed

🚀 Quick Reference:


                Settings → Privacy and Security → Security → Use secure DNS → Add custom DNS service provider

                https://dns1.oss.co.za/testclient123?dsn