OffLok makes your computer its own DNS, the address book that turns a site's name into an address. It looks up every answer at the source, starting from the root of the internet: no more internet provider, Google or Cloudflare in the middle, receiving the list of every site you visit.
Windows 10 and 11, Linux Mac coming soon Undone in one click
On the internet, every site lives at an address made of numbers, such as 185.15.58.224. Handy for machines, impossible for us to remember.
DNS (the Domain Name System) makes the link: you type a name, it finds the number. Just like a phone book.
It happens hundreds of times a day without you noticing: every site, every app, every picture, every ad and every update starts with a question to the DNS.
What is the address of en.wikipedia.org?
It's 185.15.58.224.
Made up, but realistic: no need to read your pages to learn a lot about you, the list of names is enough.
Unless you chose otherwise, it is usually your internet provider, through your router. Sometimes Google (8.8.8.8) or Cloudflare (1.1.1.1), if someone changed the setting.
That address book receives every question you ask, one after the other, with the time. And since it is the one answering, it can also decide that a site does not exist, or send you somewhere else.
With OffLok, that address book is your own computer.
With OffLok, your computer no longer asks a middleman: it finds addresses itself, walking down the DNS tree from its root. Just like its logo shows.
Your computer, with OffLokNo address book receives the list of your visits any more. Each server only learns what it needs to know, and OffLok keeps no record of what you look up.
Answers come from the source, not from a middleman choosing for you what exists. Want to block something? You decide what.
Your address book depends on no company: if your provider's DNS goes down, yours keeps going. And what it has already found stays in memory, even when a server stops answering.
When a name is signed (DNSSEC, a kind of digital seal), OffLok checks the seal on your computer and rejects a forged answer.
Blocking ads, trackers and malicious sites is included, off at first: one switch per category, a 10-minute pause, and “Trust this site” for one you miss.
The code is public (MIT licence): anyone can read and check it. No account, no ads, no subscription, no statistics sent.
We'd rather tell you straight.
Version 0.5.1, free and without an account. Turn it off or uninstall it whenever you like: your computer then gets exactly its previous settings back.
Windows 10 (version 2004 or later) and Windows 11, 64-bit
64-bit PC (Intel or AMD). Tested on Ubuntu 24.04.
Ubuntu, Debian, Linux Mint… (.deb packages)
cd "$(xdg-user-dir DOWNLOAD)" sudo apt install ./offlok_0.5.1_amd64.deb ./offlok-desktop_0.5.1_amd64.deb
Fedora and its relatives (.rpm packages)
cd "$(xdg-user-dir DOWNLOAD)" sudo dnf install ./offlok-0.5.1-1.x86_64.rpm ./offlok-desktop-0.5.1-1.x86_64.rpm
OffLok comes to the Mac right after Windows and Linux.
Phones come next. For now, OffLok installs on a computer.
64-bit ARM computers (without the window), earlier versions and release notes: it's all on GitHub.
Every release comes with a SHA256SUMS file, signed with OffLok's release key (offlok-release-45e724ba.pub.pem, Ed25519). Download SHA256SUMS and SHA256SUMS.sig next to your files, then, with OpenSSL 3:
openssl pkeyutl -verify -pubin -inkey offlok-release-45e724ba.pub.pem -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig sha256sum --ignore-missing -c SHA256SUMS
Automatic updates do this check by themselves: an update installs only if its signature is right.
OffLok's window, one click on its icon away.
OffLok starts with your computer and works quietly. Its icon, next to the clock, tells you how it's doing.
Your computer finds addresses itself, from the root.
The root servers don't answer from here (a hotel's Wi-Fi, an office network). OffLok goes through the network's DNS until they're back: reduced protection, but the internet works.
Your original settings are put back at once, and OffLok tries again a minute later.
Your computer uses its original DNS again.
Turn on strict mode. On a hotel's or a station's Wi-Fi, “Sign in to this network” opens the door for 5 minutes, the time of its sign-in page.
Every change is tested. At the slightest failure, OffLok puts your original settings back by itself.
DNS is more than forty years old. Its history shows why whoever keeps the address book matters so much.
In the days of ARPANET, the internet's ancestor, the list of names and addresses fits in a single file, HOSTS.TXT, kept up to date at SRI in California and copied by every computer. The bigger the network grows, the less that works.
Paul Mockapetris, at the University of Southern California's Information Sciences Institute, invents DNS (RFC 882 and 883, November 1983): an address book spread out as a tree. At the top the root, then .com, .org, .fr…, each branch kept by someone else. That is the tree OffLok's logo draws.
RFC 1034 and 1035 set DNS down as we still use it, nearly forty years later.
Researcher Dan Kaminsky finds that fake answers can be slipped into address books, sending their users to fake sites. On 8 July 2008, vendors around the world release a fix together. The same year, the Dutch foundation NLnet Labs releases Unbound, the free address book OffLok runs on your computer.
Google launches its public address book, 8.8.8.8, on 3 December 2009; Cloudflare follows with 1.1.1.1 on 1 April 2018. Fast and handy, but millions of people's questions end up with a handful of companies.
On 15 July 2010, the root is signed (DNSSEC): an answer can now be checked, like a wax seal, all the way to the top of the tree. OffLok does that check itself.
On 17 October 2016, for about an hour, customers of the French provider Orange trying to open google.fr, Wikipedia or OVH land on the French Interior Ministry's page for terrorist sites. A human error in Orange's address book, which shows that whoever keeps the address book decides what you see.
Stéphane Bortzmeyer, of Afnic (which runs .fr), publishes query “minimisation” (RFC 7816, March 2016): ask each server only what it needs to know. OffLok uses it: the root only sees “org”, not the whole site.
At Canal+'s request, French courts order Google, Cloudflare and Cisco to block, in their public address books, sites streaming sport illegally; Cisco chooses to shut down its OpenDNS service in France. Whatever goes through an address book can be filtered by it.
On 11 October 2026, the root changes its signing key, for the second time in its history. On 30 October, OffLok 0.5.0 comes out as free software: the DNS tree, walked by your own computer, from a root copied in more than 2,000 places around the world.
No. Every change is tested; at the slightest failure, OffLok puts your original settings back by itself and tries again a minute later. Turning it off or uninstalling it leaves your computer exactly as before.
The first visit to a site takes a fraction of a second longer, the time to walk down the tree from the root. After that, the answer is kept on your computer: it comes at once, without even going over the network.
It no longer receives your questions to answer them, but they travel in the clear over its network: it could read them as they pass, just as it sees the addresses of the servers you connect to. OffLok removes the middleman, not the pipe.
To hide the pipe too, you need a VPN or Tor, which are other tools.
These networks often block direct access to the root, or ask you to sign in on a page. OffLok then goes through the network's DNS until it can come back (the icon with an orange dot).
Would you rather never go through it? Turn on strict mode: “Sign in to this network” opens the door for 5 minutes, the time of the sign-in page. You can also set an encrypted fallback resolver (DNS over TLS), used before the network's DNS.
If you want. Blocking is included but off at first, with four switches: ads, trackers, malicious sites (phishing, scams) and your own lists. The lists come from their authors (AdGuard, HaGeZi, URLhaus and others), downloaded once a day by your computer.
A site stopped working? “Check” tells you whether it is blocked and by which list, and “Trust this site” unblocks it for good.
No catch: OffLok is free software (MIT licence). Its code is public; no account, no ads, no subscription, and it sends no statistics.
What it contacts, besides DNS servers: the blocking lists you switch on, and GitHub once a day to see whether there is a new version. That last check can be turned off with a switch.
Windows is wary of programs without a signature it recognises. A free signature for open-source software (SignPath Foundation) is being prepared for OffLok. Meanwhile, the installer is built in public by GitHub from the published code, and you can check it was not altered (see “Check what you downloaded”).
Yes. Running your own DNS address book is perfectly normal: companies, universities and internet providers do exactly the same. OffLok does not make you anonymous and changes nothing about the law: what is forbidden stays forbidden.
On Windows: Settings › Apps › Installed apps, then OffLok › Uninstall. On Linux: sudo apt remove offlok offlok-desktop (or sudo dnf remove on Fedora).
Either way, every connection of your computer gets its original DNS back.
OffLok is developed by LokLakh and published as free software: anyone can read its code, check it and suggest improvements on GitHub. It relies on Unbound, the free address book from the NLnet Labs foundation.
Free, open source, no account. And reversible at any time.