Configure Google Chrome for Secure DNSaaS

📋 Overview

Google Chrome includes built-in support for DNS-over-HTTPS (DoH) with custom providers. This guide will help you configure Chrome to use our secure DNSaaS service with token-based authentication.

Service	Endpoint	Authentication
Primary DNS	`https://dns1.oss.co.za/xxxxx{?dns}`	Token in URL path
Protocol	DNS-over-HTTPS (DoH) • Port 443 • TLS 1.3
Chrome Version	Version 80+ (all recent versions)

✅ Verified Working This configuration has been tested and confirmed working with Google Chrome. The correct format uses {?dns} with the token directly in the path.

🌐 Configure Google Chrome Step-by-Step

1 Open Chrome Settings

Click the Chrome menu (three vertical dots in the top-right corner) → select Settings.

Alternatively, type chrome://settings/ in the address bar and press Enter.

2 Navigate to Privacy and Security

In the left sidebar, click Privacy and security → then click Security.

Alternatively, type chrome://settings/security in the address bar.

3 Scroll to "Advanced" Section

Scroll down to the Advanced section.

Look for "Use secure DNS".

4 Enable Secure DNS

Toggle the switch to ON for "Use secure DNS".

Select "Choose another provider" from the dropdown menu.

💡 Important Select "Choose another provider" - this allows you to enter your token-gated endpoint.

5 Enter the Custom DoH Endpoint

Enter the following URL (replace token_testclient123 with your token):

https://dns1.oss.co.za/testclient123{?dns}

⚠️ Common Mistake

Wrong: https://dns1.oss.co.za/testclient123(?dns) ← uses parentheses

Correct: https://dns1.oss.co.za/testclient123{?dns} ← uses curly braces

Chrome requires curly braces { }, not parentheses ( ).

✅ Chrome Format

The token is in the URL path: /token_testclient123
Chrome requires the {?dns} template variable
No /dns-query path needed
This format has been tested and verified with Chrome

6 Save and Verify

The setting saves automatically. Chrome will validate the endpoint and should accept it without errors.

✅ Success Indicator The "Please verify that this is a valid provider" message should disappear and the endpoint should be accepted.

🧪 Test Your Configuration

Use these test sites to verify your Chrome configuration is working correctly.

Blocked Domains (Should NOT Load)

Test Domain	Expected Result	What You Should See
`http://zycdjz.com`	BLOCKED	DNS_PROBE_FINISHED_NXDOMAIN
`http://malware.testcategory.com`	BLOCKED	DNS_PROBE_FINISHED_NXDOMAIN
`http://phishing.testcategory.com`	BLOCKED	DNS_PROBE_FINISHED_NXDOMAIN
`http://adult.filterdns.net`	BLOCKED	DNS_PROBE_FINISHED_NXDOMAIN

Clean Domains (Should Load Normally)

Test Domain	Expected Result	What You Should See
`https://example.com`	LOAD	Normal page loads
`https://google.com`	LOAD	Normal page loads

DNS Leak Test

Test Domain	Expected Result	What You Should See
`https://dnsleaktest.com`	Your DNS Server	Should show `dns1.oss.co.za` or `102.220.218.218`

🔍 Browser Endpoint Formats Comparison

Different browsers require different endpoint formats:

🌐 Chrome {?dns} ✅ Working

🦊 Firefox /dns-query ✅ Working

🦁 Brave ?dsn ✅ Working

Browser	Endpoint Format	Example	Status
🌐 Chrome	`{?dns}` template	`https://dns1.oss.co.za/xxxxx{?dns}`	✅ Verified
🦊 Firefox	`/dns-query` suffix	`https://dns1.oss.co.za/xxxxx/dns-query`	✅ Verified
🦁 Brave	`?dsn` parameter	`https://dns1.oss.co.za/xxxxx?dsn`	✅ Verified

⚠️ Important

Chrome requires {?dns} at the end of the URL
Firefox requires /dns-query at the end
Brave requires ?dsn at the end
They are NOT interchangeable - use the correct format for each browser

🔧 Troubleshooting

❌ "Please verify that this is a valid provider"

Make sure you're using the correct format: https://dns1.oss.co.za/xxxxx{?dns}
Use curly braces { }, not parentheses ( )
Check that your token is valid and active
Verify network connectivity to dns1.oss.co.za

❌ Domains still loading when they should be blocked

Clear the DNS cache: chrome://net-internals/#dns → Clear host cache
Check that the token is correct and active
Verify the custom blocklist is loaded: /etc/powerdns/siteslist.rpz
Restart Chrome after making changes

✅ Verify It's Working

Visit chrome://net-internals/#dns and check for DNS-over-HTTPS queries
Visit http://adult.filterdns.net - should show DNS_PROBE_FINISHED_NXDOMAIN
Visit https://dnsleaktest.com - should show dns1.oss.co.za

↩️ How to Roll Back

To revert to your previous DNS settings:

Step 1: Go to Security Settings

chrome://settings/security

Step 2: Turn Off Secure DNS

Toggle the "Use secure DNS" switch to OFF.

Alternatively, select "With your current service provider" from the dropdown.

Step 3: Clear DNS Cache

Visit chrome://net-internals/#dns and click "Clear host cache".

🎯 Summary

🌐 Google Chrome supports DoH natively in Settings
✅ Working URL: https://dns1.oss.co.za/xxxxx{?dns}
🔒 All DNS queries are encrypted via DoH (port 443) with TLS 1.3
⚡ Chrome requires the {?dns} template variable
🔄 Easily toggle on/off as needed

🚀 Quick Reference:

https://dns1.oss.co.za/testclient123{?dns}

🌐 Browser Format Comparison:

Chrome:  https://dns1.oss.co.za/xxxxx{?dns}
Firefox: https://dns1.oss.co.za/xxxxx/dns-query
Brave:   https://dns1.oss.co.za/xxxxx?dsn