Numa Launches Second Public ODoH Relay

Why this is here: Numa’s ODoH relay is built into the same binary as the DNS resolver, allowing users to switch to anonymous DNS by simply changing a setting in the configuration file.

Razvan Dimescu released Numa version 0.14, shipping an ODoH client, relay, and public deployment in a single Rust binary. The software aims to provide anonymous DNS resolution without requiring accounts or platform lock-in, addressing a gap in privacy-focused options. ODoH, or Oblivious DNS over HTTPS, encrypts queries while separating IP address and request information across multiple servers.

Dimescu deployed the second public ODoH relay at odoh-relay.numa.rs on a Hetzner VPS, pairing it with Cloudflare’s odoh.cloudflare-dns.com to ensure independent operators handle each leg of the query. Building the relay required careful attention to prevent Server-Side Request Forgery attacks and to verify that the relay and target are operated by different organizations.

The current implementation does not eliminate trust in the target server, nor does it protect against traffic analysis on low-volume relays. Centralized public key distribution and a lack of DNSSEC integration also remain limitations, though future development plans address these concerns. The existing public ecosystem was previously limited to one relay operated by Frank Denis.