Haven Docs

DNS resolution

This page exists because of one honest fact: when Haven's filter allows a hostname, that hostname is forwarded to a DNS resolver outside the device. It is the single largest data flow in the app, so it should not be buried in a footnote.

What happens to each lookup#

OutcomeWhat leaves the device
BlockedNothing. Haven answers NXDOMAIN locally; the query is never forwarded
AllowedThe DNS query is forwarded, unchanged, to an upstream resolver
UnparseableForwarded untouched, so nothing is broken by a query Haven does not understand

So the resolver sees the hostnames the device looks up, minus the ones Haven blocked.

Which resolver#

Haven forwards to a well-known public resolver operated by Cloudflare (1.1.1.1).

Two properties of that choice are relevant here:

  • It is a public, privacy-focused resolver with a published privacy policy and a stated position on not selling browsing data.
  • It is not operated by Haven. Haven has no relationship with the resolver operator, no account, no API key, and no ability to correlate a query with a user — nothing identifying is attached to a forwarded query.

What is not attached#

A forwarded query carries the DNS question and nothing else. Haven does not add:

  • any user identifier, account id, or device id
  • any advertising identifier
  • any session token
  • any Haven-specific header, marker or subdomain

There is nothing in a forwarded query that identifies the query as coming from a Haven user rather than from the device's normal resolver.

Comparison with not having Haven installed#

Without Haven, the device sends its DNS queries to whatever resolver the network or the carrier provides — typically the ISP's, which usually has weaker privacy commitments than a dedicated public resolver.

With Haven, those queries go to a public privacy-focused resolver instead, and the gambling ones do not leave the device at all.

Haven is not claiming this is a privacy feature. It is a design consequence, stated so the user can judge it for themselves.

Why not use the device's own resolver#

Forwarding to whatever resolver the OS is configured with is the intuitive answer, but the tunnel replaces the system's resolver configuration while it is up, so there is no unfiltered system resolver to defer to from inside it. Using a fixed, known, public resolver is predictable and auditable, which for a protection app is worth more than following a network-supplied resolver of unknown quality.

Encrypted DNS#

Known public DNS-over-HTTPS and DNS-over-TLS resolver hostnames are on the blocklist, so an app that tries to move its lookups off the system resolver falls back to the filtered path.

This is a protection measure, not a privacy claim about the user's other traffic.

What Haven itself records#

  • Allowed lookups are not logged at all. Haven does not build, keep or transmit a browsing history.
  • Blocked lookups go into a local block log so the user can audit their own device, and that log never leaves the phone.