v0.1.12713 Aug 2026·Networking, Privacy & Shields

Encrypted DNS (DoH) inside the engine, so your network cannot see which sites you look up

The Settings screen has offered an Encrypted DNS resolver dropdown for a while, but it was cosmetic: the engine still asked the operating system to resolve every hostname, in the clear, so anyone on your network (or your ISP) could watch the list of sites you visit even when the pages themselves are encrypted. This release makes that dropdown real. The engine now performs DNS-over-HTTPS (RFC 8484) itself: it builds a DNS query, sends it to your chosen provider over TLS, and reads the answer back, so the lookups are encrypted and indistinguishable from ordinary HTTPS traffic. It is built like the rest of the stack, hand-written with no new dependencies, and it bootstraps to each provider by a curated anycast IP so it never needs a plaintext lookup to FIND the resolver. a no-logs default and other well-known resolvers are wired; any failure falls back to the OS resolver so a page never fails to load because of DoH. Proven live against a real resolver. This closes the scorecard caveat that there was no DoH inside the engine itself. Networking moves 53 to 54 and Security 38 to 39; overall holds at 52.

Parity with the reference browser

74overall, as of v0.1.343

Web APIs / DOM surface42

Security architecture66

GPU / graphics acceleration68

DevTools / extensions72

Networking85

Media85

Accessibility85

Real-world site compatibility99

HTML parsing100

CSS parsing + selectors100

Layout: block / flex / grid / tables / writing-modes100

Paint + visual100

JavaScript language100

JavaScript performance (JIT)100

HTML parsing100

What changed 3 changes

Networking	A from-scratch DNS-over-HTTPS resolver (core-net/doh.rs): builds a wire-format DNS A-record query, opens a TLS connection to the provider pinned to an HTTP/1.1 ALPN (so a provider that also speaks h2 cannot leave us sending an HTTP/1.1 request over an h2 stream), POSTs the query as application/dns-message, and parses the A records from the answer, following DNS name-compression pointers. Results are cached. Verified live end to end against a real resolver, plus unit tests for the wire query, the answer parser and the provider mapping.
Privacy & Shields	The Settings Encrypted DNS resolver dropdown is now wired to the engine: the saved provider is applied at startup, before the first navigation, and again the moment you change it. a no-logs resolver is the default and other well-known resolvers are supported, each with a curated bootstrap IP; an unrecognised or empty choice means the OS resolver.
Networking	Integrated into the connection pool: when a provider is selected the engine resolves the host it is about to connect to over DoH, and on any DoH miss it falls back to the OS resolver, so encrypted DNS is a strict privacy upgrade that can never stop a page loading. The DoH transport uses its own HTTP/1.1-only TLS config, separate from the h2-first config the pool uses for page traffic.