用于 DNS over HTTPS (DoH) 的 JSON API
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
以前，基于网络的应用需要浏览器扩展程序才能使用高级
DNS 功能（例如 DANE、DNS-SD 服务发现），甚至可以解析
以及除 IP 地址之外的任何其他信息，例如 MX 记录
如需使用依赖于 DNSSEC 的功能（如 SSHFP 记录），任何此类扩展程序
必须自行验证 DNSSEC，因为浏览器或操作系统可能不会这样做。
自 2016 年以来，Google 公共 DNS 为 DoH 提供了适用于 DNSSEC 的 Web 版 API
验证不需要浏览器、操作系统配置或扩展程序。
通过简单的 GET 查询参数和 JSON 响应，客户端可以解析
使用通用 Web API 生成多份结果，并避免复杂的 DNS 消息格式详情，例如
针对域名的指针压缩。
如需了解 DoH，请参阅常规 DoH 文档页面
通常包括 HTTP 标头、重定向处理、隐私保护最佳实践和
HTTP 状态代码。
安全传输页面
curl 命令行示例 DoH，以及 DoH 和 DNS
TLS (DoT)，例如 TLS 支持和 DNS 截断。
JSON API 规范
所有 API 调用都是 HTTP GET 请求。
如果参数重复，则仅使用第一个值。
支持的参数
- name
字符串，必需
唯一的必需参数。接受 RFC 4343 反斜杠转义。
- 长度（替换反斜杠转义后）必须介于 1 到
253 个
（如果存在可选的尾随点，则忽略）。
- 所有标签（点之间的名称部分）的长度必须为 1 到 63 个字节。
- 无效名称（如
.example.com、example..com）或空字符串 get
400 Bad Request。
- 非 ASCII 字符应采用 Punycoding 编码（
xn--qxam，而不是 ελ）。
- 类型
字符串，默认值：1
RR 类型可以表示为 [1, 65535] 中的一个数字或规范的字符串
（不区分大小写，例如 A 或 aaaa）。
您可以将 255 表示为“ANY”但要注意，这不是
用于替代发送 A 记录和 AAAA 或 MX 记录的查询。
权威域名服务器不需要返回此类查询的所有记录；
一些代码不响应，而另一些代码（如 cloudflare.com）仅返回 HINFO。
- cd
布尔值，默认值：false
CD（正在检查已停用）标志。
使用 cd=1 或 cd=true 停用 DNSSEC 验证；
使用 cd=0、cd=false 或不使用 cd 参数来启用 DNSSEC 验证。
- 个
字符串，默认：空
所需的内容类型选项。
使用 ct=application/dns-message 在
响应 HTTP 正文，而不是 JSON 文本。
使用 ct=application/x-javascript 明确请求 JSON 文本。
系统会忽略其他内容类型值，并返回默认 JSON 内容。
- do
布尔值，默认值：false
DO (DNSSEC OK) 标志。
使用 do=1 或 do=true 来包含 DNSSEC 记录（RRSIG、NSEC、NSEC3）；
使用 do=0、do=false 或不使用 do 参数来省略 DNSSEC 记录。
应用应始终处理（必要时忽略）任何 DNSSEC
记录，因为其他实现可能始终包含这些记录，
并且将来我们可能会更改 JSON 响应的默认行为。
（二进制 DNS 消息响应始终遵循 DO 标志的值。）
- edns_client_subnet
字符串，默认：空
edns0-client-subnet 选项。格式为带有子网掩码的 IP 地址。
示例：1.2.3.4/24、2001:700:300::/48。
如果您出于隐私方面的考虑而使用 DNS-over-HTTPS，并且不希望
要发送到权威域名服务器的 IP 地址的任意部分
对于地理位置精确度，请使用 edns_client_subnet=0.0.0.0/0。
Google 公共 DNS 通常会发送大致的网络信息
（通常将 IPv4 地址的最后一部分清零）。
- random_padding
字符串，已忽略
系统会忽略此参数的值。示例：XmkMw~o_mgP2pf.gpw-Oi5dK。
API 客户端担心可能存在使用
HTTPS GET 请求的数据包大小可以据此使所有请求
相同的大小。
为避免对网址的错误解读，请限制内边距字符
非预留的网址字符：
大小写字母、数字、连字符、句点、下划线和波浪号。
JSON 格式的 DNS 响应
成功的响应（此处添加的注释不会在实际响应中出现）：
{
"Status": 0, // NOERROR - Standard DNS response code (32 bit integer).
"TC": false, // Whether the response is truncated
"RD": true, // Always true for Google Public DNS
"RA": true, // Always true for Google Public DNS
"AD": false, // Whether all response data was validated with DNSSEC
"CD": false, // Whether the client asked to disable DNSSEC
"Question":
[
{
"name": "apple.com.", // FQDN with trailing dot
"type": 1 // A - Standard DNS RR type
}
],
"Answer":
[
{
"name": "apple.com.", // Always matches name in the Question section
"type": 1, // A - Standard DNS RR type
"TTL": 3599, // Record's time-to-live in seconds
"data": "17.178.96.59" // Data for A - IP address as text
},
{
"name": "apple.com.",
"type": 1,
"TTL": 3599,
"data": "17.172.224.47"
},
{
"name": "apple.com.",
"type": 1,
"TTL": 3599,
"data": "17.142.160.59"
}
],
"edns_client_subnet": "12.34.56.78/0" // IP address / scope prefix-length
}
如需了解更多详情，请参阅 RFC 7871（EDNS 客户端子网）
详细了解“作用域前缀长度”及其对缓存的影响
包含诊断信息的失败响应：
{
"Status": 2, // SERVFAIL - Standard DNS response code (32 bit integer).
"TC": false, // Whether the response is truncated
"RD": true, // Always true for Google Public DNS
"RA": true, // Always true for Google Public DNS
"AD": false, // Whether all response data was validated with DNSSEC
"CD": false, // Whether the client asked to disable DNSSEC
"Question":
[
{
"name": "dnssec-failed.org.", // FQDN with trailing dot
"type": 1 // A - Standard DNS RR type
}
],
"Comment": "DNSSEC validation failure. Please check http://dnsviz.net/d/dnssec-failed.org/dnssec/."
}
带有嵌入式引号和域名服务器归因的 SPF 和 TXT 记录：
{
"Status": 0, // NOERROR - Standard DNS response code (32 bit integer).
"TC": false, // Whether the response is truncated
"RD": true, // Always true for Google Public DNS
"RA": true, // Always true for Google Public DNS
"AD": false, // Whether all response data was validated with DNSSEC
"CD": false, // Whether the client asked to disable DNSSEC
"Question": [
{
"name": "*.dns-example.info.", // FQDN with trailing dot
"type": 99 // SPF - Standard DNS RR type
}
],
"Answer": [
{
"name": "*.dns-example.info.", // Always matches name in Question
"type": 99, // SPF - Standard DNS RR type
"TTL": 21599, // Record's time-to-live in seconds
"data": "\"v=spf1 -all\"" // Data for SPF - quoted string
}
],
"Comment": "Response from 216.239.38.110"
// Uncached responses are attributed to the authoritative name server
}
{
"Status": 0, // NOERROR - Standard DNS response code (32 bit integer).
"TC": false, // Whether the response is truncated
"RD": true, // Always true for Google Public DNS
"RA": true, // Always true for Google Public DNS
"AD": false, // Whether all response data was validated with DNSSEC
"CD": false, // Whether the client asked to disable DNSSEC
"Question": [
{
"name": "s1024._domainkey.yahoo.com.", // FQDN with trailing dot
"type": 16 // TXT - Standard DNS RR type
}
],
"Answer": [
{
"name": "s1024._domainkey.yahoo.com.", // Always matches Question name
"type": 16, // TXT - Standard DNS RR type
"data": "\"k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDrEee0Ri4Juz+QfiWYui/E9UGSXau/2P8LjnTD8V4Unn+2FAZVGE3kL23bzeoULYv4PeleB3gfm\"\"JiDJOKU3Ns5L4KJAUUHjFwDebt0NP+sBK0VKeTATL2Yr/S3bT/xhy+1xtj4RkdV7fVxTn56Lb4udUnwuxK4V5b5PdOKj/+XcwIDAQAB; n=A 1024 bit key;\""
// Data for TXT - multiple quoted strings
}
],
}
DNS 字符串
所有 TXT 记录均编码为单个 JSON 字符串，包括使用更长的 TXT 记录
录制格式，例如
RFC 4408 (SPF) 或
RFC 4871 (DKIM)。
电子 DNS
常规的 EDNS 扩展机制不受支持。
EDNS 客户端子网选项 (edns-client-subnet) 是
GET 请求和 JSON 响应中的顶级字段。
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-07-25。
[null,null,["最后更新时间 (UTC)：2025-07-25。"],[[["\u003cp\u003eGoogle Public DNS offers a web-friendly API for DNS-over-HTTPS (DoH) with DNSSEC validation, eliminating the need for browser extensions.\u003c/p\u003e\n"],["\u003cp\u003eThis API uses simple GET requests with parameters like \u003ccode\u003ename\u003c/code\u003e, \u003ccode\u003etype\u003c/code\u003e, \u003ccode\u003ecd\u003c/code\u003e, \u003ccode\u003ect\u003c/code\u003e, \u003ccode\u003edo\u003c/code\u003e, and \u003ccode\u003eedns_client_subnet\u003c/code\u003e to specify the DNS query.\u003c/p\u003e\n"],["\u003cp\u003eResponses are provided in JSON format, containing details like DNS status, answer records, and optional DNSSEC information.\u003c/p\u003e\n"],["\u003cp\u003eThe API supports various DNS record types and features such as EDNS Client Subnet for location-aware queries and DNSSEC validation for enhanced security.\u003c/p\u003e\n"],["\u003cp\u003eFor detailed information on DoH, secure transports, and privacy practices, refer to the provided documentation links.\u003c/p\u003e\n"]]],["Google Public DNS offers a web-friendly API for DNS-over-HTTPS (DoH) using simple HTTP GET requests and JSON responses. Key parameters include `name` (required domain), `type` (record type), `cd` (disable DNSSEC), `do` (include DNSSEC records), `ct` (content type), and `edns_client_subnet` (client IP). Responses include status, data, and DNSSEC validation information. The API allows clients to avoid complex DNS formatting and supports DNSSEC validation without browser extensions.\n"],null,["# JSON API for DNS over HTTPS (DoH)\n\nPreviously, web-based applications required browser extensions to use advanced\nDNS features such as [DANE](https://en.wikipedia.org/wiki/DANE), [DNS-SD service discovery](http://www.infoq.com/articles/rest-discovery-dns), or even to resolve\nanything other than IP addresses -- like MX records.\nTo use DNSSEC-dependent features like [SSHFP records](https://cloud.google.com/dns/docs/dnssec-advanced#sshfp), any such extensions\nwould have to validate DNSSEC themselves, as the browser or OS might not do so.\n\nSince 2016, Google Public DNS has offered a web-friendly API for DoH with DNSSEC\nvalidation that does not require browser or OS configuration or extensions.\nSimple GET query parameters and JSON responses allow clients to parse the\nresults using common web APIs and avoid complex DNS message format details like\n[pointer compression for domain names](https://www.kb.cert.org/vuls/id/23495/).\n\nSee the general [DoH documentation page](/speed/public-dns/docs/doh) for information about DoH\ngenerally, such as HTTP headers, redirect handling, privacy best practices, and\nHTTP status codes.\n\nThe [Secure Transports](/speed/public-dns/docs/secure-transports#doh) page has\n`curl` command line examples for DoH, and information common to DoH and DNS over\nTLS (DoT), such as TLS support and DNS truncation.\n\nJSON API Specification\n----------------------\n\nAll API calls are HTTP GET requests.\nIn the case of duplicate parameters, only the first value is used.\n\n### Supported parameters\n\nname\n\n: string, required\n\n The only required parameter. RFC 4343 backslash escapes are accepted.\n\n - The length (after replacing backslash escapes) must be between 1 and [253](https://stackoverflow.com/a/28918017/18829) (ignoring an optional trailing dot if present).\n - All labels (parts of the name betweendots) must be 1 to 63 bytes long.\n - Invalid names like `.example.com`, `example..com` or empty string get 400 Bad Request.\n - Non-ASCII characters should be [punycoded](https://en.wikipedia.org/wiki/Punycode) (`xn--qxam`, not `ελ`).\n\ntype\n\n: string, default: `1`\n\n RR type can be represented as a number in \\[1, 65535\\] or a canonical string\n (case-insensitive, such as `A` or `aaaa`).\n You can use `255` for 'ANY' queries but be aware that this is *not* a\n replacement for sending queries for both A and AAAA or MX records.\n Authoritative name servers need not return all records for such queries;\n some do not respond, and others (such as cloudflare.com) return only HINFO.\n\ncd\n\n: boolean, default: `false`\n\n \u003cbr /\u003e\n\n The CD (Checking Disabled) flag.\n Use `cd=1`, or `cd=true` to disable DNSSEC validation;\n use `cd=0`, `cd=false`, or no `cd` parameter to enable DNSSEC validation.\n\nct\n\n: string, default: empty\n\n Desired content type option.\n\n Use `ct=application/dns-message` to receive a binary DNS message in the\n response HTTP body instead of JSON text.\n Use `ct=application/x-javascript` to explicitly request JSON text.\n Other content type values are ignored and default JSON content is returned.\n\ndo\n\n: boolean, default: `false`\n\n \u003cbr /\u003e\n\n The DO (DNSSEC OK) flag.\n Use `do=1`, or `do=true` to include DNSSEC records (RRSIG, NSEC, NSEC3);\n use `do=0`, `do=false`, or no `do` parameter to omit DNSSEC records.\n\n Applications should always handle (and ignore, if necessary) any DNSSEC\n records in JSON responses as other implementations may always include them,\n and we may change the default behavior for JSON responses in the future.\n (Binary DNS message responses always respect the value of the DO flag.)\n\n \u003cbr /\u003e\n\nedns_client_subnet\n\n: string, default: empty\n\n The edns0-client-subnet option. Format is an IP address with a subnet mask.\n Examples: `1.2.3.4/24`, `2001:700:300::/48`.\n\n If you are using DNS-over-HTTPS because of privacy concerns, and do not want\n *any* part of your IP address to be sent to authoritative name servers\n for geographic location accuracy, use `edns_client_subnet=0.0.0.0/0`.\n Google Public DNS normally sends approximate network information\n (usually zeroing out the last part of your IPv4 address).\n\nrandom_padding\n\n: string, ignored\n\n The value of this parameter is ignored. Example: `XmkMw~o_mgP2pf.gpw-Oi5dK`.\n\n API clients concerned about possible side-channel privacy attacks using the\n packet sizes of HTTPS GET requests can use this to make all requests exactly\n the same size by padding requests with random data.\n To prevent misinterpretation of the URL, restrict the padding characters\n to the [unreserved URL characters](http://stackoverflow.com/a/695469/18829):\n upper- and lower-case letters, digits, hyphen, period, underscore and tilde.\n\n### DNS response in JSON\n\nA successful response (comments added here are not present in actual responses): \n\n {\n \"Status\": 0, // NOERROR - Standard DNS response code (32 bit integer).\n \"TC\": false, // Whether the response is truncated\n \"RD\": true, // Always true for Google Public DNS\n \"RA\": true, // Always true for Google Public DNS\n \"AD\": false, // Whether all response data was validated with DNSSEC\n \"CD\": false, // Whether the client asked to disable DNSSEC\n \"Question\":\n [\n {\n \"name\": \"apple.com.\", // FQDN with trailing dot\n \"type\": 1 // A - Standard DNS RR type\n }\n ],\n \"Answer\":\n [\n {\n \"name\": \"apple.com.\", // Always matches name in the Question section\n \"type\": 1, // A - Standard DNS RR type\n \"TTL\": 3599, // Record's time-to-live in seconds\n \"data\": \"17.178.96.59\" // Data for A - IP address as text\n },\n {\n \"name\": \"apple.com.\",\n \"type\": 1,\n \"TTL\": 3599,\n \"data\": \"17.172.224.47\"\n },\n {\n \"name\": \"apple.com.\",\n \"type\": 1,\n \"TTL\": 3599,\n \"data\": \"17.142.160.59\"\n }\n ],\n \"edns_client_subnet\": \"12.34.56.78/0\" // IP address / scope prefix-length\n }\n\nSee [RFC 7871 (EDNS Client Subnet)](https://tools.ietf.org/html/rfc7871) for\ndetails about \"scope prefix-length\" and how it affects caching.\n\nA failure response with diagnostic information: \n\n {\n \"Status\": 2, // SERVFAIL - Standard DNS response code (32 bit integer).\n \"TC\": false, // Whether the response is truncated\n \"RD\": true, // Always true for Google Public DNS\n \"RA\": true, // Always true for Google Public DNS\n \"AD\": false, // Whether all response data was validated with DNSSEC\n \"CD\": false, // Whether the client asked to disable DNSSEC\n \"Question\":\n [\n {\n \"name\": \"dnssec-failed.org.\", // FQDN with trailing dot\n \"type\": 1 // A - Standard DNS RR type\n }\n ],\n \"Comment\": \"DNSSEC validation failure. Please check http://dnsviz.net/d/dnssec-failed.org/dnssec/.\"\n }\n\nSPF and TXT records with embedded quotes and name server attribution: \n\n {\n \"Status\": 0, // NOERROR - Standard DNS response code (32 bit integer).\n \"TC\": false, // Whether the response is truncated\n \"RD\": true, // Always true for Google Public DNS\n \"RA\": true, // Always true for Google Public DNS\n \"AD\": false, // Whether all response data was validated with DNSSEC\n \"CD\": false, // Whether the client asked to disable DNSSEC\n \"Question\": [\n {\n \"name\": \"*.dns-example.info.\", // FQDN with trailing dot\n \"type\": 99 // SPF - Standard DNS RR type\n }\n ],\n \"Answer\": [\n {\n \"name\": \"*.dns-example.info.\", // Always matches name in Question\n \"type\": 99, // SPF - Standard DNS RR type\n \"TTL\": 21599, // Record's time-to-live in seconds\n \"data\": \"\\\"v=spf1 -all\\\"\" // Data for SPF - quoted string\n }\n ],\n \"Comment\": \"Response from 216.239.38.110\"\n // Uncached responses are attributed to the authoritative name server\n }\n\n {\n \"Status\": 0, // NOERROR - Standard DNS response code (32 bit integer).\n \"TC\": false, // Whether the response is truncated\n \"RD\": true, // Always true for Google Public DNS\n \"RA\": true, // Always true for Google Public DNS\n \"AD\": false, // Whether all response data was validated with DNSSEC\n \"CD\": false, // Whether the client asked to disable DNSSEC\n \"Question\": [\n {\n \"name\": \"s1024._domainkey.yahoo.com.\", // FQDN with trailing dot\n \"type\": 16 // TXT - Standard DNS RR type\n }\n ],\n \"Answer\": [\n {\n \"name\": \"s1024._domainkey.yahoo.com.\", // Always matches Question name\n \"type\": 16, // TXT - Standard DNS RR type\n \"data\": \"\\\"k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDrEee0Ri4Juz+QfiWYui/E9UGSXau/2P8LjnTD8V4Unn+2FAZVGE3kL23bzeoULYv4PeleB3gfm\\\"\\\"JiDJOKU3Ns5L4KJAUUHjFwDebt0NP+sBK0VKeTATL2Yr/S3bT/xhy+1xtj4RkdV7fVxTn56Lb4udUnwuxK4V5b5PdOKj/+XcwIDAQAB; n=A 1024 bit key;\\\"\"\n // Data for TXT - multiple quoted strings\n }\n ],\n }\n\n### DNS strings\n\nAll TXT records are encoded as a single JSON string including uses of longer TXT\nrecord formats such as\n[RFC 4408 (SPF)](https://tools.ietf.org/html/rfc4408#section-3.1.3) or\n[RFC 4871 (DKIM)](https://tools.ietf.org/html/rfc4871#section-3.6.2.2).\n\n### EDNS\n\nThe general [EDNS extension mechanism](https://en.wikipedia.org/wiki/Extension_mechanisms_for_DNS) is not supported.\nThe EDNS Client Subnet option (edns-client-subnet) is a parameter in the\nGET request and a top level field in the JSON response."]]
