DoHPilot is a Windows-focused local DNS-over-HTTPS manager. It keeps a JSON list of upstream DoH servers, tests them with real DNS wire queries, and exposes a local RFC 8484 endpoint for browser configuration.
The management window and system tray use the Rust windui crate. The dashboard shows the local service, endpoint, selected upstream, reachability statistics, test targets, background-check settings, Edge integration, and a fixed-column upstream table with native tray actions.
The bright shield/compass/network icon was generated with Agnes Image and is stored in assets/dohpilot-icon.png. Derived resources include assets/dohpilot-icon-256.png, assets/dohpilot-icon-16.rgba for the WindUI tray, and assets/dohpilot.ico for the Windows executable resource.
Windows x64 builds are published on the Releases page. Each v* tag produces a standalone .exe, a .zip, and a SHA-256 checksum file.
cargo build --release
cargo run --releaseThe project uses the latest stable Rust toolchain and the MSVC Windows target. The optimized executable is written to target/release/doh-pilot.exe.
The default endpoint is https://127.0.0.1:5053/dns-query. Configuration is stored under the platform user config directory in DoHPilot/config.json. Starting the service creates localhost.crt and localhost.key beside that configuration file.
New configurations include Cloudflare, Google, Quad9, EasyMosdns (apad.pro), 0ms, CIRA Canadian Shield, LDC, CN优化DOH, 香港DOH, A美国DOH, B美国DOH, 秦始皇, ZABC, fluxdo-0 through fluxdo-3, and cloudflare (Gateway). Existing configurations receive this catalog once during the versioned configuration migration; manually removed entries are not re-added afterward.
The GUI can update an Edge profile's Preferences file (dns_over_https.mode and dns_over_https.templates). If that is unavailable on Windows, the registry policy fallback writes HKCU\\Software\\Policies\\Microsoft\\Edge. Restart Edge after applying a setting. The local certificate must be trusted by Windows before using an HTTPS browser endpoint; import localhost.crt into the Current User Trusted Root Certification Authorities store (for example with certmgr.msc).
The forwarding service accepts GET with the RFC 8484 dns base64url query parameter and POST with application/dns-message. It forwards the wire message to the selected upstream and returns the upstream DNS message unchanged. When periodic re-test is enabled, the Tokio background monitor re-tests enabled upstreams at the configured interval; the GUI can then auto-select the lowest-latency reachable server. On Windows, the tray menu exposes service start/stop, quick switch to a reachable server, and exit; non-Windows builds use a no-op tray fallback.