Running the second public ODoH relay
Details
- External ID
- 48133561
- Source
- HN
- Company
- —
- Product
- Running the second public ODoH relay
- Website domain
- numa.rs
- Launched
- May 14, 2026
- Cohort
- —
- Upvotes
- 125
- Upvotes percentile
- 0.9297253634894992
- Tags
- —
- Fetched at
- Sept. 7, 2026, 9:26 p.m.
- Updated at
- Sept. 7, 2026, 9:26 p.m.
Description
Every privacy-focused DNS service requires an account: NextDNS, Cloudflare for Families, Apple's iCloud Private Relay (paid, iOS-only). The protocol that doesn’t require one - ODoH - had basically one well-known public relay operator (Frank Denis on Fastly Compute, default in dnscrypt-proxy). I built a second one and the client to talk to it.
Enrichment
- Theme
- self-hosted infrastructure and security tools
- Vertical
- Security
- Function
- Data infrastructure
- Audience
- Developer
- AI stance
- Not AI
- Project type
- Hobby / open-source project
- Normalized one-liner
- odoh relay infrastructure
- Manually corrected
- False
Could you build this?
Partial The basic client/server flow can be vibe-coded, but implementing an Oblivious DoH (ODoH) relay requires strict cryptographic protocol adherence (HPKE/RFC 9230) and high-throughput networking.
What it would actually take: The service requires a low-latency proxy in Rust or Go implementing RFC 9230, handling HPKE (Hybrid Public Key Encryption) encapsulation and decapsulation to separate DNS queries from client IP addresses. Key challenges include maintaining strict zero-logging memory safety, managing global edge deployment to minimize latency overhead, and complying with IETF cryptographic specifications for oblivious networking.
Discussion
20 comments analyzed.
Competitors mentioned: DNSCrypt-proxy with DoHoT, Tor, ECH (Encrypted Client Hello), Tailscale
Concerns raised: Relay and target operators can collude to access query data, DNS providers purchase user query data for commercial purposes, Concentrates power to Cloudflare, Does not hide client IP address, Leaks to multiple parties along network path
Feature requests: Run as a service on macOS, Integration with Tailscale as fallback resolver, Pluggable system to replace tsdproxy, Docker socket service discovery, Solution for namesquatting prevention
Competitors
Other products that read as similar to this one — 88 launches clear the similarity bar, closest 8 shown.
Attention rank: #9 of 89 (itself plus its competitors, highest first — normalized so YC and Product Hunt are compared fairly).
Launched 197 days after the earliest competitor.
- OctoDNS, Tools for managing DNS across multiple providers · hn · 2025-11-19 · 31 upvotes · similarity 0.45
- RelayCloud · ph · 2026-09-26 · 2 upvotes · similarity 0.44
- Faro · ph · 2026-09-19 · 2 upvotes · similarity 0.43
- vps-ssh-with-tailscale · github · 2026-09-19 · 9 upvotes · similarity 0.38
- Open database tracking 77K public DNS servers every 10 minutes · hn · 2025-12-18 · 7 upvotes · similarity 0.38
- SMTP Tunnel · hn · 2026-01-07 · 140 upvotes · similarity 0.38
- ReSocks · ph · 2026-09-11 · 2 upvotes · similarity 0.37
- authepy · ph · 2026-09-30 · 2 upvotes · similarity 0.37
Other launches for this product
- No other launches for this product.
Same idea, different domain
Nobody's really built a data infrastructure tool for Media & entertainment yet.