# doxx.net: full text > Published canonical pages of https://www.doxx.net/ as plain text, generated from the > prerendered HTML at build time. Articles are also published as markdown: > Blog: /blog//index.md; machine-readable index: /blog/index.json. > Insights: /insight//index.md; machine-readable index: /insight/index.json. ## Agentic Defined Network - doxx.net URL: https://www.doxx.net/ Product Resources Pricing Get Started They know, we don’t They know what you search, where you go, who you talk to. And now they’re learning what your agents do for you. We don’t Nothing to log. Nothing to know. doxx.net is an Agentic Defined Network (ADN).They know what you search, where you go, who you talk to.And now they’re learning what your agents do for you.We don’tNothing to log. Nothing to know.doxx.net is an Agentic Defined Network (ADN).doxx.net is an Agentic Defined Network (ADN). Get Started Zero-log infrastructure 42M threats blocked Native IPv6 connectivity Sub-millisecond threat detection A new category of network Agentic Defined Network (ADN) Give your agents private channels and control over tunnels, IPs, and firewalls. 01 Problem Your internet is rented Your activity crosses infrastructure you don’t control. People and agents leave traces. 02 Solution Remove the middle People and agents share private channels on one network. P2P Comms connects devices directly. 03 doxx.net The network you build Our IP space, DNS root, and hardware. Your agents configure the network by API. P2P Communication Conversations, device to device Calls, messages and files. End-to-end encrypted between people and agents. AI Assistant Talk to your agents privately, on your own devices. NetDrop Transfer full, unmodified files between devices. Group Chat End-to-end encrypted chat. On-device translation. No provider-held logs. Call Private voice calls with voice filters Message Encrypted messages with on-device translation Video Video calls with accepted friends only. No provider-held call records. Voice memo Send voice memos directly, with voice filters. Core capabilities Privacy, communication, and network control Agentic Defined Networking Give your agents an identity and private network controls. Privacy Control how you connect and protect your network identity. P2P E2EE Comms Call, chat, and share files directly between devices. Security – DNS Encrypt DNS lookups and block unwanted domains. Connectivity & Routing Choose how traffic reaches your devices and services. Private Networking & Services Connect your devices and services in one private network. Infrastructure in numbers We protect you and your agents 30 Filter lists 42M Threats blocked 13.5M+ AI training samples 2M+ Threat domains Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Announcement doxx.net raised $38M, led by a16z, to build the first agentic network. Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Community - doxx.net URL: https://www.doxx.net/community/ Product Resources Pricing Get Started Open community doxx.net People building together Public code on GitHub Build with us Building in public, together Get help with doxx.net, share your setup, and contribute feedback or code. Join the DiscordExplore open source Community channels Find help and share what you build Discord Ask setup questions, get help, and talk with other users.Join Discord Reddit Share your setup and compare notes with other doxx.net users.Browse Reddit GitHub Read the code, report bugs, and contribute changes.Explore GitHub Open source projects Explore our apps and the open-source tools we share with the community. Visit GitHub DarkFlare TCP-over-CDN firewall piercing DevSocket Real-time debug log streaming for iOS & Android zmsBERT AI DNS threat classifier doxx.net on GitHub Project overview and API documentation Community FAQ How do I join the community? Join us on Discord, Reddit, or GitHub. Discord is for chat and support, Reddit for discussion, and GitHub for code and contributions. Do I need to be technical to participate? No. Whether you’re a network engineer or new to privacy, you can ask questions, learn, and share what would make doxx.net more useful to you. Is the community free? Yes. The community is free to join. You do not need to be a paying customer to participate. How do I report a bug or security issue? Report bugs on GitHub, in #help-and-questions on Discord, or by emailing support@doxx.net. Please report security vulnerabilities privately by email. Can I contribute if I'm not a developer? Yes. Share feedback, report problems, show what you’re building, improve documentation, or help other users. Code is only one way to contribute. What are the community rules? Be respectful, constructive, and helpful. Read the full Code of Conduct for the details. Follow us Get product updates and join the conversation. X Reddit YouTube Discord Instagram X Reddit YouTube Discord Instagram Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Company - doxx.net URL: https://www.doxx.net/company/ Product Resources Pricing Get Started Open beta Access to information is a right, not a privilege doxx.net exists to give people back an internet that serves them. About doxx.net doxx.net is a parallel internet built on its own DNS root, IP space, encrypted mesh, and agent-driven networking. The company owns the infrastructure that runs the platform. Founder Built by Barrett Lyon Barrett Lyon founded Prolexic, BitGravity, XDN, and Defense.net. He is building doxx.net around infrastructure the company owns and operates. Explore the product Mission A network you control Connect your devices and agents through private channels. Linux-vps Online 10.10.0.3 iPhone 17 Online 10.10.0.4 Macbook Offline 10.10.0.5 Home-rpi Offline 10.10.0.6 AI-Agent Online 10.10.0.7 EXPLORE Get to know doxx.net See the platform, connect an agent, or explore the public source. Explore the platform See features for private browsing, calls, file sharing, and network management. View product Connect your agent Follow the setup guide to connect your agent to doxx.net. Read setup guide Build with us Read the code, report bugs, or suggest changes on GitHub. Open GitHub Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Download - doxx.net URL: https://www.doxx.net/download/ Product Resources Pricing Get Started Download Create an account first, then install doxx.net to get started! iOS Android Agents Download for iOSRequires iOS 17.2 or later. Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Support - doxx.net URL: https://www.doxx.net/support/ Product Resources Pricing Get Started Talk to us How can we help? Most answers are a click away below. Feel free to join our community channels for additional support. Join the DiscordFind on Reddit Answers first Find an answer Start with technical documentation, common support questions, or the latest service status. Documentation Setup guides and how-tos Follow step-by-step guides to install, configure, and use doxx.net. Help Center The questions everyone asks Find answers to common questions and troubleshoot installation, connectivity, and product issues. Status Something down? Check here first Check for active incidents, scheduled maintenance, and service disruptions. Connect with us Get in touch Choose the channel that best matches your question or request. Support Get help with installation, connectivity, technical issues, or general questions about doxx.net. Email support Community Ask questions, share feedback, and connect with the doxx.net team and other community members. Join DiscordVisit Reddit Legal Contact us about legal matters, privacy requests, or questions concerning our Terms of Service and Privacy Policy. Email the legal team Business Contact us about partnerships, integrations, enterprise deployments, or other business opportunities. Contact our business team Press Contact us for interviews, company information, media assets, or other press inquiries. Email team Security Report a suspected vulnerability or security issue affecting doxx.net. Report issueDisclosure policy Offices Our offices address Americas doxx.net corp 382 NE 191st St, PMB 87376, Miami, FL 33179-3899, United States Europe Doxx Communications Europe GmbH MSA - 41A route des Jeunes, 1227 Carouge, Geneva, Switzerland Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Privacy Policy - doxx.net URL: https://www.doxx.net/privacy/ Product Resources Pricing Get Started Privacy Policy doxx.net corp, a Delaware corporation Last Updated: September 30, 2026 1.Our Commitment doxx.net was built from the ground up with a single purpose: to protect the privacy and freedom of our users. This is not a marketing statement. It is an engineering decision embedded in every layer of our infrastructure. We operate a fully vertical technology stack. We do not rely on third-party services for any core function of the platform. Every component, from our DNS resolvers to our authentication system, from our human verification to our network routing, is designed, built, and operated in-house by doxx.net engineers. This means no third party touches your network traffic or your communications, because no third party is involved in operating the network. Payment processing is the one exception, and it is described in Section 2. 2.Vertical Infrastructure: No Third Parties Unlike other privacy services that depend on external vendors, doxx.net owns and operates: Our own autonomous network – We operate our own BGP-peered network across 20+ global points of presence. Your traffic never passes through a third-party VPN provider. Our own DNS infrastructure – We wrote our own DNS resolver from scratch in Go. We do not use BIND, Unbound, or any public DNS software. Our DNS servers are custom-built, purpose-designed, and run on our own anycast network. Our own human verification (DOXX POW) – We do not use Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, or any third-party verification service. Our proof-of-work system runs entirely on our servers with zero external API calls. Our own authentication system – Token-based, no passwords, no email required. No Auth0, no Firebase, no Okta. Globally isolated private authentication infrastructure built in-house. Our own monitoring and statistics – No Google Analytics, no Mixpanel, no Datadog, no Sentry. Our real-time monitoring system is custom-built and stores data only in volatile memory. Our own certificate infrastructure – Self-signed certificates with client-side pinning for transport security, eliminating dependency on public certificate authorities for core VPN operations. Our own encrypted mesh network – All doxx.net servers are interconnected via a private WireGuard mesh backbone. User-to-user traffic travels entirely over this encrypted mesh and never exits to the public internet. The only external service involvement is payment processing. Plans and add-ons are purchased on the doxx.net website and processed by Stripe, Inc. Stripe receives the information needed to process a charge. doxx.net never sees or stores card numbers. We store only a billing reference needed to renew your plan, and we hold it separately from the network. Payment records are never associated with network activity. Apple and Google distribute our apps and do not process payments for the Service. 3.No-Logs Policy We do not collect, store, monitor, or log: Browsing history or website visits DNS queries or resolutions Connection timestamps, duration, or frequency Real IP addresses (source IPs are never stored; see Section 7) Bandwidth usage per user VPN session metadata Any content of your communications Call records, message logs, or communications metadata from P2P Comms. Calls, video calls, chat, voice memos, and file transfers travel directly between devices, so no provider-held record of them can exist on our side User agent strings or device fingerprints We have no ability to associate network activity with any individual user. This is not a policy choice. It is an architectural reality. The systems are not built to capture this data. 4.What We Collect We collect the minimum data necessary to operate the Service: Account token: A randomly generated authentication string. No email address, no username, and no password is required to create an account. VPN tunnel configuration: WireGuard public keys and internally assigned VPN IP addresses. These are internal network addresses used for routing, not your real IP address. Feature preferences: Your settings such as Smart Blocking configuration, firewall rules, web privacy preferences, and covert communications options. Optional recovery information: If you voluntarily provide an email address or phone number for account recovery, it is stored. Most users do not provide this. Recovery codes: Stored as one-way cryptographic hashes. The original codes cannot be recovered from storage. Subscription data: A billing reference from our payment processor, your plan, and your subscription status are stored for plan, device, and seat management. This data is held separately from the network and is not linked to network activity. Terms of Service acceptance: A record that you accepted the terms, and when. No IP address or device information is recorded. Custom DNS domains: If you register a .doxx domain on the parallel internet, the domain name and ownership are stored. 5.Security Dashboard & Statistics (Opt-In Only) If you choose to enable security statistics, the following data is processed to power your real-time security dashboard: Blocked domain names and security events are held in volatile RAM (server memory) only. This data is never written to disk and is permanently lost if the statistics server restarts or is interrupted. Data is organized into time-series buckets (1-second through 6-hour windows) for your dashboard visualizations. All data is keyed to a tokenized tunnel reference, not to your identity. This data is available only to your authenticated session via an encrypted WebSocket connection. It is not shared with any third party or used for any purpose other than displaying your personal security dashboard. If you enable bandwidth statistics, upload and download byte counts are processed in the same volatile, in-memory manner described above. 6.Diagnostic Data (Opt-In Only) Diagnostics are off by default. If you choose to help us debug a problem, you can turn on diagnostic reporting in the app. When enabled, the app sends the following to servers we operate: application logs, crash reports, tunnel and connection diagnostics such as handshake results, transport in use, latency and error codes, device model, operating system version, and app version. 7.IP Address Handling doxx.net does not store real IP addresses anywhere in our systems. TOS acceptance: No IP address or user agent is recorded. Human verification (DOXX POW): A one-way SHA-256 hash of your IP is temporarily stored for abuse prevention. This hash cannot be reversed to obtain your actual IP address. Challenge data expires and is automatically deleted within one hour. VPN tunnel IPs: The IP addresses stored in your tunnel configuration are internally assigned VPN addresses (e.g., 10.x.x.x), not your real public IP address. Server logs: We do not log client IP addresses in application logs. 8.Connection State We maintain a record of whether your VPN tunnel is currently active and which server it is connected to. This is operational data used for load balancing and service health, not a connection log. Only the current state is stored; no history of connections is maintained. 9.Cookies & Web Tracking The doxx.net portal uses session cookies for authentication only. We do not use: Analytics trackers of any kind Advertising pixels or retargeting tags Third-party scripts that phone home to external servers Fingerprinting libraries Any form of cross-site tracking Checkout pages are hosted by our payment processor and are the only pages where a third party's code runs. They are described in Section 2. No payment processor code runs inside the doxx.net apps. 10.What We Never Do We never sell, rent, license, or share user data with any third party. We never serve advertisements or participate in ad networks. We never use third-party analytics or monitoring services. We never inject content, headers, or tracking into your traffic. We never cooperate with data brokers. We never retain data beyond what is described in this policy. We never build interception capabilities, weaken our encryption, or add logging that targets a person or class of persons, in response to any request, from anyone. 11.Legal Requests We may receive legal requests for user data. Because we do not log user activity, we have no traffic data, browsing history, DNS queries, or connection metadata to provide. Our architecture ensures we cannot produce records that do not exist. We will comply with valid legal process to the extent we are able, which in practice means confirming whether an account token exists and when it was created. What process we require. doxx.net corp is a Delaware corporation subject to United States legal process. We respond only to valid legal process issued by a court of competent jurisdiction and properly served on our registered agent. We do not act on informal requests or on orders served directly by foreign authorities; foreign requests must proceed through mutual legal assistance mechanisms, where they are tested against United States law. We review every demand for legal sufficiency and scope, and we challenge demands that are overbroad, improper, or unlawful. User notification. Unless we are legally prohibited from doing so, our policy is to notify an affected user before any disclosure in response to legal process, so they may challenge it themselves. Where a nondisclosure order expires, our policy is to notify the user once it does. Transparency report. We publish a transparency report at doxx.net/transparency, updated at least twice per year and promptly after any notable legal event, describing in aggregate the legal demands we receive, from which jurisdictions, what was sought, and what was produced. Where we are lawfully permitted to publish a request and our response in full, we do. 12.Takedown Requests, Copyright, and Abuse For traffic that transits our network, doxx.net acts as a conduit: we transmit our users' communications without selecting, modifying, or storing their content. There is no transited content on our servers to take down. Notices concerning content on third-party websites should be directed to the party hosting that content. Where doxx.net operates name and address infrastructure, such as domains that resolve inside the parallel internet or leased IP addresses, we act on valid complaints at the level we control: a name, an address lease, or a token's access may be suspended or terminated for violations of our Terms of Service, including under our repeat-infringer policy, without our being able to identify the person behind the token. Reserved brand names are blocked across all our top-level domains. Copyright notices under the DMCA may be sent to our designated agent at legal@doxx.net [register the designated agent with the U.S. Copyright Office and insert the registered details here]. Network abuse, including malware distribution, phishing infrastructure, or denial-of-service activity, may be reported to abuse@doxx.net. We investigate every report against the resources we control. What we cannot do, for anyone, is identify a user, produce their history, or monitor their traffic: the capability does not exist. 13.Your Privacy Rights Where privacy laws such as the EU and UK GDPR or the California Consumer Privacy Act grant you rights over personal data, we honor them for the data we actually hold, described in Section 4. For most of what those laws contemplate, our honest answer is that the right cannot be exercised because the data cannot be linked to you: we cannot produce, correct, or delete a person's browsing history, connection records, or communications because no such records exist or can be tied to an identity. We do not sell or share personal information, we do not process it for targeted advertising, and we do not profile users. To exercise rights over the data we do hold, or to delete your account and all associated data, contact legal@doxx.net or use in-app account deletion. Data breach notification. In the event of a breach affecting the data described in Section 4, we will notify affected users and regulators as required by applicable law. The categories of data that could ever be affected are limited to that inventory, which is why it is short. 14.Data Retention Account data: Retained while your account is active. Upon account deletion, all associated data is permanently removed from our database cluster across all nodes. DOXX POW data: Expires and is automatically deleted within one hour. Security dashboard data: Exists only in volatile RAM. Lost permanently on server restart. Not recoverable. Diagnostic data: Collected only while you have opted in. Deleted within [30] days of receipt, or sooner once your report is resolved. 15.Children's Privacy The Service is not directed at children under 13. We do not knowingly collect data from children under 13. 16.Changes to This Policy We may update this Privacy Policy periodically. The effective date at the top indicates the most recent version. Continued use of the Service after changes constitutes acceptance. 17.Verification This privacy policy was verified against the doxx.net production codebase, database schema, and server infrastructure by an independent AI code audit (Claude Opus 4.6, Anthropic) on February 7, 2026. The audit reviewed the database schema, all APIs and source code, the DNS resolver, the statistics server, and the human verification system to confirm that the statements in this policy accurately reflect the system's actual data handling practices. Sections added after that date [Sections 11 additions, 12, and 13] are pending the same verification and counsel review; this note will be updated when the next audit completes. The payment processing statements in Sections 1, 2, 4, and 9 and the diagnostic data section (Section 6) reflect the move to website billing and the opt-in diagnostics feature, and are pending the same verification. 18.Contact For questions about this Privacy Policy, please contact us at: legal@doxx.net For abuse reports: abuse@doxx.net Legal process is accepted only by service on our registered agent. Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Terms of Service - doxx.net URL: https://www.doxx.net/terms/ Product Resources Pricing Get Started Terms of Service doxx.net corp, a Delaware corporation Last Updated: September 30, 2026 1.Introduction These Terms of Service ("Terms") govern your use of the VPN and related software, apps, websites, and services provided by doxx.net corp ("doxx.net," "we," "us," or "our"). By accessing or using the service (the "Service"), you agree to these Terms. If you do not agree, do not use the Service. We prioritize user privacy and anonymity and operate using a minimal-data, no-activity-logs approach as described below and in our Privacy Policy. 2.Privacy & Data Handling No-Logs Policy: We do not log user activity, browsing history, DNS queries, or connection metadata that could be tied to an individual. Minimal Data: We may store minimal operational data necessary for Service performance (e.g., server load metrics), never linked to an identifiable user. Payments: We accept payment methods that allow anonymity (e.g., cryptocurrency, credit cards, and cash options). Payment processors may collect limited transaction data, but we do not associate this with user activity. Transparency: Our privacy practices may be detailed in a separate Privacy Policy, which forms part of these Terms. 3.Acceptable Use Policy You agree not to misuse the Service. This includes, but is not limited to: Engaging in unlawful activities (e.g., distribution of child sexual abuse material, terrorism, harassment, fraud, unauthorized access to systems). Infringing on intellectual property rights (e.g., unlawfully distributing copyrighted content). Harming networks, servers, or other users. Circumventing technical measures, rate limits, or Service restrictions. We reserve the right to suspend or terminate accounts for egregious abuse. 4.Service Description & Availability The Service is provided on a best-effort basis. We do not guarantee uninterrupted access, specific speeds, or compatibility with every website, app, or service. Server locations and features may change without notice. Scheduled or unscheduled downtime may occur. 5.Accounts, Security & Authentication You are responsible for securing your account credentials (if any). We are not liable for damage resulting from unauthorized account access due to your negligence. 6.Payments, Renewals, Refunds & Taxes Payments: The Service may be offered on a subscription basis. Pricing is available on our website. Refund Policy: Refunds may be available within a defined period (e.g., 30 days) from the initial purchase, unless prohibited by law. Renewals: If you choose auto-renewal, your subscription will renew automatically until canceled. Taxes: You are responsible for applicable taxes, unless we are required by law to collect them. 7.Intellectual Property & Open Source All rights, title, and interest in the Service remain with doxx.net corp or its licensors. Certain components may be offered under open-source licenses; in such cases, those licenses govern use. 8.Legal Process, Transparency & Warrant Canary We may comply with valid legal processes served on us, but we have no records of user activity to provide. Where legally permissible, we will issue transparency reports or warrant canaries to inform users of government requests. 9.Export, Sanctions & Regulatory Compliance You agree to comply with applicable export control, sanctions, and trade compliance laws. You may not use the Service in violation of U.S. sanctions or export restrictions. 10.Disclaimers The Service is provided "as is" and "as available." We disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement. 11.Limitations of Liability To the maximum extent permitted by law, doxx.net corp shall not be liable for indirect, incidental, or consequential damages (including lost profits or data). Our total liability shall not exceed the amount you paid for the Service in the 12 months preceding the claim. 12.Indemnity You agree to indemnify and hold harmless doxx.net corp, its officers, employees, and affiliates from claims, damages, liabilities, and expenses arising out of your use of the Service or breach of these Terms. 13.Suspension & Termination You may stop using the Service at any time. We may suspend or terminate access without notice if you breach these Terms or engage in prohibited activities. 14.Governing Law, Arbitration & Class-Action Waiver These Terms shall be governed by the laws of Delaware, USA, without regard to conflict of law rules. Any disputes shall be resolved through binding arbitration in Delaware. You waive the right to participate in class actions or jury trials. 15.Miscellaneous If any provision is found unenforceable, the remainder shall remain in effect. These Terms constitute the entire agreement between you and doxx.net corp regarding the Service. 16.Changes to These Terms We may update these Terms periodically. The date at the top indicates the most recent version. Continued use after changes constitutes acceptance. 17.Contact For questions about these Terms, please contact us at: legal@doxx.net Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Pricing - doxx.net URL: https://www.doxx.net/pricing/ Product Resources Pricing Get Started Connectivity Security Full Control Open betaStatusActive OPEN BETA Try doxx.net for free Browse with less tracking, share files privately and give your agents controlled network access. Your trial includes every Pro feature. Start free trialFree beta trial for 30 days Plans for every level of security Essential $6 a month Subscribe nowPrivate browsing and DNS protection 2 device seats and 1 agent seat DNS protection and private calls, chat and files Add a device or agent for $1/month Pro $16 a month Subscribe nowPrivate networking and agent management 5 device seats and 5 agent seats Everything in Essential, plus agent and network controls Covert Networking, Onion Routing and Port Forwarding Add-ons Available on Essential and Pro. Billed monthly. Additional Device or Agent $1/month Dedicated IP $10/month doxx.net domain $1/month Compare Essential and Pro Essential and Pro feature comparisonFeature Essential Pro Device seats 2 on Essential 5 on Pro Agent seats 1 on Essential 5 on Pro Privacy Web Privacy Included in Essential Included in Pro Network Fingerprint Included in Essential Included in Pro Self-Destruct PIN Included in Essential Included in Pro Kill Switch Included in Essential Included in Pro Covert Networking Not included in Essential Included in Pro Onion Routing Not included in Essential Included in Pro P2P E2EE Comms P2P NetDrop Included in Essential Included in Pro P2P Chat Included in Essential Included in Pro P2P Voice Call Included in Essential Included in Pro P2P Video Call Included in Essential Included in Pro Agentic Defined Networking Agentic Network Management Not included in Essential Included in Pro Agent Gateway Not included in Essential Included in Pro Agent Identity Not included in Essential Included in Pro MCP & API Not included in Essential Included in Pro Security – DNS Smart Blocking Included in Essential Included in Pro DNS Bypass Protection Included in Essential Included in Pro Secure DNS Included in Essential Included in Pro Security Insights Included in Essential Included in Pro Native IPv6 Included in Essential Included in Pro Firewall Included in Essential Included in Pro Connectivity & Routing Connection Auto-Tuning Included in Essential Included in Pro Network Insights Included in Essential Included in Pro Dedicated IP Add-on on Essential Add-on on Pro Port Forwarding Not included in Essential Included in Pro Private Networking & Services Split Tunneling Included in Essential Included in Pro doxx.net domain Add-on on Essential Add-on on Pro Bring Your Own Domain Not included in Essential Included in Pro DNS Infrastructure Not included in Essential Included in Pro Private PKI Not included in Essential Included in Pro Pricing FAQ How does the free beta trial work? Try doxx.net Pro free for 30 days. Choose your plan and add a payment method when you sign up. You pay nothing until your trial ends, and you can cancel anytime. Should I pick Essential or Pro? Choose Essential for private browsing, DNS protection, calls, chat and file sharing. It includes 2 devices and 1 agent for $6/month. Choose Pro for the same features plus agent controls, private networking, Covert Networking, Onion Routing and Port Forwarding. It includes 5 devices and 5 agents for $16/month. What counts as a seat? Each connected device or agent uses one seat. Essential includes 2 device seats and 1 agent seat, and Pro includes 5 device seats and 5 agent seats. Add another device or agent for $1/month. Is there a discount for paying yearly? Yes. Pay yearly and get 2 months free: Essential is $60 a year and Pro is $160 a year. Can I add more to my plan? Yes, on either plan. Add a device or agent for $1/month, a dedicated IP for $10/month, or a doxx.net domain for $1/month. Add-ons bill monthly, even on a yearly plan. Can I switch plans, pause or cancel? Yes, anytime. Sign in to the web portal and go to Account, then Subscriptions. While your plan is paused, you pay nothing and your devices stay offline until you resume. Where can I get help? Our Discord community helps with setup, and our team answers billing questions at support@doxx.net. Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Blog - doxx.net URL: https://www.doxx.net/blog/ Product Resources Pricing Get Started Blog Guides to the private internet, from setup to network control RSS 1 Oct 2026 8 min read Announcements Welcome to the Agentic Networking Era Barrett Lyon introduces doxx.net and Agentic Defined Networking: private networks that people and AI agents can build and operate. Barrett Lyon 1 Oct 2026 6 min read Networking CGNAT was an emergency fix. We made it the default, and it neutered the Internet. How carrier-grade NAT conserved IPv4 addresses, made direct connections harder and changed what peers and builders can do online. Barrett Lyon 1 Oct 2026 3 min read Networking OMG, are we having fun building the agentic networking future. See how doxx.net combines its own infrastructure, an encrypted mesh and in-house AI to connect people and agents. Barrett Lyon AllNetworkingAnnouncements All Posts 1 Oct 2026 Announcements Welcome to the Agentic Networking Era Barrett Lyon introduces doxx.net and Agentic Defined Networking: private networks that people and AI agents can build and operate. Barrett Lyon 8 min read 1 Oct 2026 Networking CGNAT was an emergency fix. We made it the default, and it neutered the Internet. How carrier-grade NAT conserved IPv4 addresses, made direct connections harder and changed what peers and builders can do online. Barrett Lyon 6 min read 1 Oct 2026 Networking OMG, are we having fun building the agentic networking future. See how doxx.net combines its own infrastructure, an encrypted mesh and in-house AI to connect people and agents. Barrett Lyon 3 min read Follow along Stay in the loop DiscordRedditXLinkedInRSS Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Insights - doxx.net URL: https://www.doxx.net/insight/ Product Resources Pricing Get Started Insights Perspectives on privacy, networking and internet technology RSS 6 Oct 2026 6 min read security Blocking Encrypted DNS Traffic: What It Means and What to Check Learn what an encrypted DNS warning means, how blocking affects privacy, and how to check device settings, network controls and DNS fallback. doxx.net Editorial 6 Oct 2026 9 min read privacy Can website owners see who visits? Website owners can see visit data, but usually not your name. Learn how logins, cookies, and identity matches affect privacy and what you can limit. doxx.net Editorial 6 Oct 2026 11 min read Networking Can You Access Your NAS From Anywhere? Yes, you can access your NAS from outside your home network once you configure remote access. doxx.net Editorial AllNetworkingengineeringprivacysecuritytroubleshooting All Posts 6 Oct 2026 security Blocking Encrypted DNS Traffic: What It Means and What to Check Learn what an encrypted DNS warning means, how blocking affects privacy, and how to check device settings, network controls and DNS fallback. doxx.net Editorial 6 min read 6 Oct 2026 privacy Can website owners see who visits? Website owners can see visit data, but usually not your name. Learn how logins, cookies, and identity matches affect privacy and what you can limit. doxx.net Editorial 9 min read 6 Oct 2026 Networking Can You Access Your NAS From Anywhere? Yes, you can access your NAS from outside your home network once you configure remote access. doxx.net Editorial 11 min read 6 Oct 2026 security AI Browser Agent Security: Current Risks and Practical Controls AI browser agents remain vulnerable to prompt injection. Learn how scoped access, execution controls, approvals and recovery tests limit exposure. doxx.net Editorial 9 min read 6 Oct 2026 security EAP methods for Wi-Fi: what they mean and which to choose Understand EAP-TLS, PEAP and EAP-TTLS, match your enterprise Wi-Fi profile, validate server certificates and troubleshoot authentication failures. doxx.net Editorial 10 min read 6 Oct 2026 security Firewall Configuration: Build, Apply and Test a Least-Privilege Ruleset Learn how to scope firewall rules, preserve administrative access, test allowed and blocked paths, and review changes before migration. doxx.net Editorial 6 min read 6 Oct 2026 Networking How to Change Your Wi-Fi Channel Change your router’s Wi-Fi channel, choose settings for each band, test performance, and learn what to do if channel controls are locked. doxx.net Editorial 6 min read 6 Oct 2026 security How to encrypt Telnet traffic Protect Telnet with compatible IPsec or TLS endpoints, require encryption, check path coverage, and test that plaintext access is blocked. doxx.net Editorial 6 min read 6 Oct 2026 Networking How to Find the IP Address of a Printer Find your printer's IP address using its display, a network report, Windows or Mac settings, or your router. Confirm the address before printing. doxx.net Editorial 10 min read 6 Oct 2026 Networking How to Fix Slow DNS Lookup Measure DNS lookup delays on Windows, macOS and Linux, identify the slow layer, apply a targeted fix, and retest without breaking private access. doxx.net Editorial 11 min read 6 Oct 2026 Networking How to Lower Ping in Online Games Lower gaming ping by testing Ethernet, pausing heavy transfers and comparing game regions. Diagnose lag spikes and know when to contact your ISP. doxx.net Editorial 10 min read 6 Oct 2026 Networking How to Reduce Packet Loss Reduce packet loss with controlled Wi-Fi, Ethernet and congestion tests. Learn how to measure results, apply targeted fixes and escalate persistent issues. doxx.net Editorial 10 min read 6 Oct 2026 Networking Network connectivity: how it works and how to check it Network connectivity lets devices exchange data. Learn how wired and wireless links work and how to check reachability, DNS and application access. doxx.net Editorial 8 min read 6 Oct 2026 security On-path attacks: how interception works and how to protect your traffic An on-path attacker intercepts traffic between devices. Learn how attacks work, what HTTPS protects, which warning signs matter, and how to respond. doxx.net Editorial 10 min read 6 Oct 2026 engineering How to Prevent an LLM from Accessing Confidential Development Data Keep confidential data out of LLM context with isolated workspaces, sanitized inputs, retrieval authorization, tool permissions and boundary tests. doxx.net Editorial 10 min read 6 Oct 2026 Networking RDP Port: Default, Custom Listener and Gateway Ports RDP defaults to TCP 3389 and can also use UDP 3389. Learn gateway ports, how to check the listener, and how to change it with recovery steps. doxx.net Editorial 6 min read 6 Oct 2026 security Secure Internal Communication: Protect Messages, Calls, Files, and Services Learn how to secure internal messages, calls, files, and services with encryption, access controls, device protection, policies, and practical checks. doxx.net Editorial 9 min read 6 Oct 2026 engineering Specify an SSH Port When Connecting Use ssh -p to connect on a specific port. Learn how to save the port in SSH config, select ports in scp and sftp, and check failed connections. doxx.net Editorial 6 min read 6 Oct 2026 Networking Subnet Cheat Sheet: IPv4 Masks, Host Counts and Boundaries Look up IPv4 subnet masks, usable hosts and wildcard masks. Calculate subnet boundaries, size address blocks and compare IPv6 prefix capacities. doxx.net Editorial 9 min read 6 Oct 2026 troubleshooting How to Fix “This Site Can’t Provide a Secure Connection” Check the error code, compare browsers and networks, and troubleshoot clock, browser, or HTTPS settings without bypassing certificate warnings. doxx.net Editorial 6 min read 12 Follow along Stay in the loop DiscordRedditXLinkedInRSS Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Product - doxx.net URL: https://www.doxx.net/product/ Product Resources Pricing Get Started All features Everything you can do with doxx.net Browse privately, talk to friends and connect your devices, services and agents. DownloadView guides Agentic Defined Networking Agentic Network Management Let your agents set up tunnels, IPs, firewalls, and private channels. Agent Gateway Bring people and agents into conversations across your private network. Agent Identity Recognize agents and the owners responsible for their network presence. MCP & API Let authorized agents manage your network through the API and MCP tools. P2P E2EE Comms P2P NetDrop Double-encrypted, forward-secret file transfer, device to device P2P Chat End-to-end encrypted chat. On-device translation. No provider-held logs. P2P Voice Call Private calls with voice filters. No provider-held call records. P2P Video Call Video calls with accepted friends only. No provider-held call records. Security – DNS Smart Blocking Filter unwanted domains with blocklists and your own access rules. DNS Bypass Protection Help prevent DNS requests from bypassing your chosen connection settings. Secure DNS Encrypt DNS lookups between your device and the resolver over HTTPS or TLS. Security Insights See blocked activity, its threat category, and why each request was blocked. Native IPv6 Use IPv6 connectivity for the devices and services on your network. Firewall Block incoming connections unless you explicitly allow them. Connectivity & Routing Connection Auto-Tuning Adapt connection settings as network conditions change during everyday use. Dedicated IP Give your connection a consistent public IP for services that need one. Port Forwarding Make selected services reachable through the network ports you choose. Network Insights See live upload and download activity, latency, and ping for your connection. Privacy Covert Networking Disguise tunnel traffic as the kinds of traffic a network expects to see. Onion Routing Split your traffic so it leaves through several exit locations at once. Web Privacy Mask browser signals so that different sites see different identities. Network Fingerprint Keep device and network signals consistent with your browser profile. Self-Destruct PIN Activate an emergency privacy response with a dedicated security PIN. Kill Switch Stop traffic from leaving your device when the tunnel connection drops. Private Networking & Services doxx.net domain Give your services memorable names under domains such as .doxx and .x. Bring Your Own Domain Import a domain you already own and verify it with a DNS TXT record. DNS Infrastructure Resolve every network domain and standard internet domain in one place. Private PKI Issue certificates to establish trust for services on your network. Split Tunneling Choose what goes through doxx.net and what connects directly. Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## AI agent networking features - doxx.net URL: https://www.doxx.net/product/agentic-defined-network/ Product Resources Pricing Get Started Networking for AI agents Agentic Defined Network Let authorized agents manage network settings and exchange encrypted messages and files. Connect Your Agents Agentic Network Management Let authorized agents create tunnels and manage IP addresses, DNS settings, and firewall rules. Agent Identity Give your agent a chat identity and choose who it can message. Agent Kill Switch Revoke an agent’s access if it behaves unexpectedly or you suspect a compromise. Agent Gateway Exchange encrypted messages and files with your agents through the doxxGateway API or Model Context Protocol (MCP). Personal Assistant Research Agent Support Agent Coding Agent Connect Your AgentsAsk your agent to read config.doxx.net for setup instructions. Available apps Take your network anywhere Try doxx.net Pro free for 30 days.Payment method required. See trial details Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## P2P E2EE Comms - doxx.net URL: https://www.doxx.net/product/p2p-communication/ Product Resources Pricing Get Started P2P E2EE Comms Private chat, calls, and file sharing Connect directly between devices with end-to-end encryption. Connect Your Agents P2P Chat End-to-end encrypted chat. On-device translation. No provider-held logs. P2P Voice Call Private calls with voice filters. No provider-held call records. P2P Video Call Video calls with accepted friends only. No provider-held call records. P2P NetDrop Double-encrypted, forward-secret file transfer, device to device Connect Your AgentsAsk your agent to read config.doxx.net for setup instructions. Available apps Take your network anywhere Try doxx.net Pro free for 30 days.Payment method required. See trial details Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Privacy and Security - doxx.net URL: https://www.doxx.net/product/privacy-and-security/ Product Resources Pricing Get Started Privacy Browse with less tracking Use browser privacy controls and private routing to reduce tracking. Protect Your Privacy Web Privacy Mask identifying browser details in supported web traffic to reduce fingerprint-based tracking. Self-Destruct PIN Delete locally stored app data with a separate PIN if you’re forced to unlock the app. Onion Routing Route your traffic through separate entry and exit relays on doxx.net’s network. Covert Networking Use HTTPS or WebSocket tunneling to help your encrypted connection pass through restrictive network filters. Protect Your PrivacySet up tracking protection and private routing in the doxx.net app. Available apps Take your network anywhere Try doxx.net Pro free for 30 days.Payment method required. See trial details Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Security – DNS - doxx.net URL: https://www.doxx.net/product/dns-threat-protection/ Product Resources Pricing Get Started Security – DNS DNS filtering and threat protection Filter unwanted domains and encrypt your DNS lookups. Set Up DNS Protection Secure DNS Encrypt DNS lookups between your device and doxx.net’s resolvers using HTTPS or TLS. DNS Bypass Protection Help keep apps on your chosen DNS resolver on supported connections. Public DNS Resolver Use doxx.net’s public DNS resolver without connecting to a tunnel. Smart Blocking Block known malicious, advertising and tracking domains with rules for each tunnel. Set Up DNS ProtectionChoose your filters and connect your devices to doxx.net’s DNS service. Available apps Take your network anywhere Try doxx.net Pro free for 30 days.Payment method required. See trial details Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Private Networking & Services - doxx.net URL: https://www.doxx.net/product/private-networking/ Product Resources Pricing Get Started Private Networking & Services Private networking and services Choose which devices can reach your private services. Build Your Private Network Mesh Networking Reach services on selected devices without exposing them to the public internet. doxx.net domains Reach your services by name using a .doxx domain or a domain you already own. Private PKI Issue certificates that let your devices verify the identity of private services. Network Insights Check connection status, traffic and blocked DNS lookups to troubleshoot access and filtering. Build Your Private NetworkConnect your devices, name your services, and review network activity. Available apps Take your network anywhere Try doxx.net Pro free for 30 days.Payment method required. See trial details Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Connectivity & Routing - doxx.net URL: https://www.doxx.net/product/connectivity-routing/ Product Resources Pricing Get Started Connectivity & Routing Internet connectivity and routing Your connection should do more than get you online. Configure your connection Native IPv6 Connect to IPv6-enabled services through doxx.net while retaining IPv4 connectivity for other services. Port forwarding Allow incoming internet connections to selected services on your devices, such as a web server. Dedicated IPv4 Use an IPv4 address reserved for you, rather than sharing an address with other users. Connection Auto-Tuning Let doxx.net adjust connection settings as network conditions change, so you don’t have to tune them manually. Configure your connectionChoose an exit location, reserve an IP address, or set up port forwarding. Available apps Take your network anywhere Try doxx.net Pro free for 30 days.Payment method required. See trial details Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Help Center - doxx.net URL: https://www.doxx.net/help/ Product Resources Pricing Get Started Help Center How can we help? Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpAll topics Overview What doxx.net is, why we built it and how an Agentic Defined Network works. Quick Start Download the app, create your account, connect and share the network. Features What each part of the doxx.net platform does. FAQ Answers to the questions people ask most. Account and Device Sign in, delete your account and share seats. Billing Plans, payment details, invoices, pausing and cancelling. Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Welcome to the Agentic Networking Era: introducing doxx.net URL: https://www.doxx.net/blog/welcome-to-the-agentic-networking-era/ Product Resources Pricing Get Started Our Blog Welcome to the Agentic Networking Era Barrett Lyon introduces doxx.net and Agentic Defined Networking: private networks that people and AI agents can build and operate. On this page Introducing doxx.net The Internet You Use, Uses You The Same Problem Is Here for Agents Agentic Defined Networking Boundaries the Network Enforces Nobody in the Middle, at Any Layer Your First Freedom Call Come Build With Us Introducing doxx.net In 2003, I sat in a conference room with the FBI and watched a DDoS extortion crew take down an online casino in real time. The attackers were on one continent. The victim was on another. The network in between belonged to a dozen companies that could not coordinate a response. The casino was paying $40,000 a week in protection money because, at that point, it was cheaper to pay criminals than to rely on the internet to defend itself. That was not a bug. It was the architecture. The casino was paying because it depended on a network it did not own. I have been thinking about that room ever since. I spent more than 20 years building, defending, mapping, and breaking apart networks, and every one of them taught me the same lesson. The internet was built to move packets. It was not built for privacy, direct control, or a world where every person carries a computer and AI agents are about to browse, communicate, configure systems, and act on our behalf. Then we stacked ad networks, cloud platforms, tracking systems, identity providers, billing systems, and policy departments on top of it. We called the result “the Internet.” What we actually built was a surveillance machine with good uptime. Somewhere along the way I stopped asking how to defend the internet we have and started asking what a network built for the people on it would look like. Today we are launching what came out of that question: the open beta of doxx.net, and with it, Agentic Defined Networking (ADN). The Internet You Use, Uses You Your network is not really yours. Someone else resolves your names, assigns your addresses, routes your traffic, holds your messages, your files, your call records, and increasingly, the behavioral data that explains who you are. Look at what actually happens online. You think you are messaging a friend. You are messaging a server first. You think you are calling someone. You are calling a cloud platform. You think you are sharing a file. You are uploading it to somebody else’s infrastructure and hoping it gets deleted when the company says it will. We accepted this because it made products easy to build. It also made everyone easy to observe. End-to-end encryption is important, but does not erase the architecture around it. If your traffic still runs through a company’s servers, that company still sees the surrounding data and still decides what persists. Better encryption is good. Fewer middlemen is better. That is not privacy. That is renting access to your own life. Privacy should not depend on whether the company in the middle has good intentions this quarter. The Same Problem Is Here for Agents Now we are about to give AI agents access to everything. They will browse the web, read documents, call APIs, move data, configure infrastructure, trigger workflows, communicate with people, and make decisions at speeds and volumes no human can match. Most will do it from the same public internet that already turns ordinary activity into metadata for somebody else. An agent with access to your calendar, contacts, code, financial information, documents, and internal systems is not “just another app.” It is an extension of you. It needs boundaries around where it can go, what it can resolve, what it can touch, and what it leaves behind. Everyone is talking about prompts, jailbreaks, and whether agents will say something weird. Fine. Those are real problems. But the more basic question is this: what network are these agents running on, and who gets to watch everything they do? Right now, the answer is usually: everybody with infrastructure in the middle. Your agents need boundaries: where they can go, what they can resolve, what they can touch, and what they leave behind. Those boundaries cannot live in a prompt. They have to live in the network. Agentic Defined Networking That is what we built. Agentic Defined Networking means you and your agents run on a network you own, and your agents help build and operate it. Owning your own network was always possible. It just required a network engineer. Now the agent that is going to live on your network can build it. With doxx.net, an agent creates the private network, configures security policy, establishes private names, sets firewall rules, leases public IP addresses, connects devices, and manages the secure paths your people, services, devices, and agents use to communicate. This is not an agent drawing a network diagram and congratulating itself. It is an agent building and operating a real network, under your policy, with your own address space, naming, and trust boundaries. You can give an agent its own identity and link it directly to your phone, so it reaches you inside an environment you control. Then the network your agent built becomes the network you use: to call a friend, share a file, run a private service, or let one agent talk to another. The boundaries your agents need are no longer a policy document. They are the network. Boundaries the Network Enforces Security should not begin after someone clicks the phishing link or an agent visits a malicious destination. On doxx.net it begins before the connection exists. DNS Protection blocks the destination before you or your agent ever reach it. Since December 2025 it has blocked more than 38 million threats, growing at more than 1.2 million a week by combining 30 filtering lists with neural-network detection that catches malicious destinations static lists have not seen yet. That is where your agents can go and what they can resolve, decided in the network, not in a prompt. The same network makes you harder to see. Web Privacy masks the signals browsers and devices leak for fingerprinting: screen size, fonts, language, operating system, rendering characteristics. Onion Routing moves traffic through multiple relays so identity and activity stay apart. Covert Networking uses six protocols that make private traffic look like ordinary web activity, for places where VPN traffic gets flagged or blocked. That leaves the last boundary, what they leave behind. It is the one you cannot fake. Nobody in the Middle, at Any Layer Privacy claims are cheap. Anyone can put “no logs” on a landing page. It is much harder to build a system that has less to collect, less to retain, and less to hand over when somebody comes asking. The only way to do that is to take the middleman out of every layer. So that is what we did. The infrastructure. doxx.net is not a prettier tunnel into a public cloud. We physically built the core layers ourselves: our own autonomous system and IP space, DNS root and private naming system, certificate authority and trust model, encrypted mesh, and dedicated hardware across a global backbone. We did not rent servers. We painstakingly built our own metal, server by server, card by card, connection by connection in every data center, so we control the full stack end to end. Your identity. doxx.net uses proof-of-work and tokens instead of usernames, passwords, emails, and phone numbers. Events are processed in memory instead of assembled into a permanent, user-linked behavioral archive. Your names and trust. You can run your own TLDs, internal domains, and certificate authority, so your services resolve inside your network without depending on public DNS or somebody else’s trust hierarchy. Your communications. doxx P2P Comms gives you and your agents calling, chat, voice memos, and unmodified file transfer directly between devices and agents, across the encrypted mesh. No central communications server. No cloud calling platform. No staged file bucket. No provider-held call-detail archive. No message log waiting for someone to ask for it. Your First Freedom Call The first time I made a call across the network, I kept thinking about what had just happened. An agent had configured the network. It had helped set the policy and allocate the address space. Then I called someone through my own private network, with no phone company and no central server in the middle. No one had created a record of the call, because there was nowhere for one to be created. In 2003, I watched a network fail someone because of how it was built. This one could not record my call for the same reason. That was our first freedom call. Yours is next. Come Build With Us The open beta is live. We have native apps for iOS, macOS, and Android, with Windows and Linux support, running on a global backbone. Tell your agent to go to config.doxx.net and have it explain the setup to you and configure your network. Put traffic on it. Build a network. Make a freedom call. Then tell us what breaks. That is how we build something better. If you are an engineer tired of fighting the public internet’s limitations, a founder building distributed systems or AI agents, someone operating from difficult networks, or simply someone done trusting companies that have not earned it, come see what we built. Join our Discord community. Download the beta at doxx.net. Barrett (aka Doxx) On this page Introducing doxx.net The Internet You Use, Uses You The Same Problem Is Here for Agents Agentic Defined Networking Boundaries the Network Enforces Nobody in the Middle, at Any Layer Your First Freedom Call Come Build With Us Author Barrett Lyon Category Announcements Published 1 Oct 2026 Reading time 08 minutes Ask an AI assistant Share this article Related insights Read more articles 1 Oct 2026 Networking CGNAT was an emergency fix. We made it the default, and it neutered the Internet. How carrier-grade NAT conserved IPv4 addresses, made direct connections harder and changed what peers and builders can do online. Barrett Lyon 6 min read 1 Oct 2026 Networking OMG, are we having fun building the agentic networking future. See how doxx.net combines its own infrastructure, an encrypted mesh and in-house AI to connect people and agents. Barrett Lyon 3 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## CGNAT and the loss of direct Internet connections - doxx.net URL: https://www.doxx.net/blog/cgnat-was-an-emergency-fix/ Product Resources Pricing Get Started Our Blog CGNAT was an emergency fix. We made it the default, and it neutered the Internet. How carrier-grade NAT conserved IPv4 addresses, made direct connections harder and changed what peers and builders can do online. On this page I grew up on direct internet The emergency What we actually gave up Privacy didn't get a free pass either We kept the workaround and canceled the repair What comes next must leverage IPv6 and circumvent CGNAT Come build with us The internet didn't downgrade by accident. I watched it happen. I've spent my whole career inside this network. I mapped it with the Opte Project. I defended it at Prolexic when botnets were trying to knock half of e-commerce offline. I've written tools that tunnel TCP over DNS and over CDNs just to prove packets can still find a way. So when I tell you the internet quietly traded away its founding principle, I'm not theorizing. I was in the room. The trade happened one rational decision at a time. Make things connect. Conserve scarce resources. Keep the old world running one more year. Every one of those decisions made sense. Then we made the temporary ones permanent. Carrier-Grade NAT (CGNAT) is the clearest example. It stretched the final years of IPv4, and in doing so, it turned the internet from a network of reachable peers into a world of clients, clouds, relays, and middlemen. It wasn't a conspiracy. It was worse than a conspiracy: it was a technically rational shortcut that got institutionalized because everyone in the room could make it work. An entire industry decided it was easier to preserve IPv4 than to preserve the end-to-end internet. I grew up on direct internet The original internet ran on one powerful idea: endpoints reach endpoints. If you had a routable address, another host could connect straight to you. You could run a server from your bedroom. Host a game. Move a file to a friend without asking permission. You didn't need five SaaS vendors, a CDN, a relay service, and a venture-backed platform standing between two people who wanted to talk. The network moved packets. It didn't need to understand your business model. It didn't need to be your identity provider. It didn't need to become a permanent middleman. It was messy. It was also glorious. Then IPv4 ran out. The emergency IPv4 is a 32-bit address space of about 4.3 billion addresses. That sounded infinite until every human started carrying three connected devices and every company put its infrastructure online. NAT was the first workaround: a whole house sharing one public address. CGNAT took the same trick to the carrier level by putting thousands of customers behind a small pool of public addresses, with the standards bodies carving out 100.64.0.0/10 as dedicated shared space to make it official. I want to be fair here, because I've operated networks under real constraints: CGNAT was a reasonable emergency response. Providers had IPv4-only devices to serve, IPv6 was half-deployed, and IPv4 addresses were getting absurdly expensive. They needed to connect the next customer. But "emergency" is supposed to mean temporary. Instead, we built the world on top of the tourniquet. What we actually gave up CGNAT demoted you from participant to guest. Your phone, your laptop, your home network: the address they hold may not be reachable from the public internet at all. Your traffic gets translated by carrier-owned equipment before it goes anywhere. If your home router is already doing NAT, you're behind two layers: one you own, one you don't. Try hosting a service from home. Try receiving an inbound connection. Try running a multiplayer game, a camera, a peer-to-peer app, or remote access without a third party in the middle. Sometimes it works, after a ridiculous dance of port mappings, hole punching, relay servers, subscriptions, and support tickets. I've written some of those workarounds myself. The fact that they need to exist is the indictment. And when direct connectivity gets hard, centralization gets easy. You stop sending the file to your friend; you upload it to a cloud. You stop hosting; you rent. Builders stop building on the network and start building on the intermediaries who can route around it. Every layer of translation is a dependency, every dependency is a chokepoint, and every chokepoint is a place where connectivity can fail, policy can be imposed, traffic can be observed, or access can be sold back to you. The internet got easier to control as it got harder to reach. Privacy didn't get a free pass either CGNAT isn't a surveillance product. But it is a structural correlation point. When thousands of subscribers share one public address, the carrier has to map internal addresses, ports, and timestamps just to make the system function. More translation means more infrastructure sitting between you and the internet, more places where your activity can be associated, logged, and inspected. The privacy industry has spent a decade patching this from above. Add a VPN. Add a browser extension. Add encrypted DNS. Add another proxy. Some of it helps. But if the architecture underneath is still built on intermediaries, you're mostly choosing which intermediary gets the best view of your life. That's not privacy. That's outsourcing trust. We kept the workaround and canceled the repair IPv6 was the actual fix. It offers address space vast enough to make every endpoint reachable again. The CGNAT standards were explicitly framed as a bridge to it. But bridges have a way of becoming destinations. CGNAT relieved the pressure, providers kept adding customers, and the migration everyone promised became the migration nobody prioritized. Today, direct reachability isn't normal. It's a premium feature you buy, configure, or hack around. What comes next must leverage IPv6 and circumvent CGNAT I'm not nostalgic for 1998, and you shouldn't be either. We need modern cryptography, real resilience, serious abuse protection, and we're about to need all of it at a scale nobody's honest about, because billions of AI agents are about to become the heaviest users of every network on earth. Those agents are inheriting an internet built for billing, reachability workarounds, and observation, not autonomy, not privacy, not direct control. If we keep treating duct tape as architecture, we'll automate the same failures at machine speed. The next internet has to assume that endpoints can talk without defaulting to someone else's relay. That your identity and your activity don't automatically land in the same database. That naming and trust don't require kneeling before a handful of public intermediaries. That security kills threats in the network instead of generating alerts after the damage. That people, and their agents, run on infrastructure designed to minimize surveillance, not monetize it. Come build with us I got tired of writing essays about it, so I'm building the fabric instead. It's called doxx.net: our own autonomous system, our own naming, an encrypted mesh where endpoints are endpoints again: reachable, private, and yours. If any of this resonates and, if you remember what it felt like when the network was actually yours, come see what we're building at doxx.net. Kick the tires, put some traffic on it, and tell me what you think. On this page I grew up on direct internet The emergency What we actually gave up Privacy didn't get a free pass either We kept the workaround and canceled the repair What comes next must leverage IPv6 and circumvent CGNAT Come build with us Author Barrett Lyon Category Networking Published 1 Oct 2026 Reading time 06 minutes Ask an AI assistant Share this article Related insights Read more articles 1 Oct 2026 Networking OMG, are we having fun building the agentic networking future. See how doxx.net combines its own infrastructure, an encrypted mesh and in-house AI to connect people and agents. Barrett Lyon 3 min read 1 Oct 2026 Announcements Welcome to the Agentic Networking Era Barrett Lyon introduces doxx.net and Agentic Defined Networking: private networks that people and AI agents can build and operate. Barrett Lyon 8 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Building the agentic networking future - doxx.net URL: https://www.doxx.net/blog/welcome-to-the-agentic-network/ Product Resources Pricing Get Started Our Blog OMG, are we having fun building the agentic networking future. See how doxx.net combines its own infrastructure, an encrypted mesh and in-house AI to connect people and agents. On this page Welcome to the agentic network: doxx.net Welcome to the agentic network: doxx.net This is something we’ve handcrafted across the planet from the ground up. We designed and deployed our own servers, built our own network stacks, APIs and database systems, self-hosted our AI inference, and built a global encrypted mesh network, with an app that ties everything together, plus a growing collection of tools designed to help agents work with humans. And we’re just getting started. This has the feeling of the start of the Internet again. This has been an absolute blast. It’s something I’ve been dreaming about for years, but until recently I never had the opportunity to dedicate 12+ hours a day to actually building it. We’ve done quite a few things differently at doxx.net, and we’re going to use this blog as an opportunity to explain those decisions, talk about the architecture, share our open-source projects, discuss what worked and what didn’t, and generally document what happens when you rethink how a global network should operate from first principles. One of the biggest differences is that doxx.net doesn’t have traditional systems administrators or network administrators. There isn’t a NOC full of people manually adjusting routes, tuning paths, or operating the backbone. The network is operated by our in-house AI system. We named it “nonoc” and it works much better 24/7 than having humans run the global mesh backbone. And, more secure. Our encrypted mesh is fully interconnected across our global sites, so site-to-site traffic travels across an encrypted backbone rather than simply being handed off to the public Internet. That same network carries our peer-to-peer services: calls, video calls, chats, file transfers and other applications. The result is multiple layers of security. Applications provide their own end-to-end or application-layer encryption, while the underlying traffic is also protected as it moves across the encrypted mesh. This architecture gives us something we care deeply about: sovereign networking. We don’t need to know what you’re doing. We don’t log your activity. We don’t use sFlow or NetFlow to reconstruct what is happening across the network. In fact, we designed our operational telemetry differently so that the system responsible for keeping the network healthy doesn’t even require a global view of individual user IP addresses. There is another important consequence to this design: there aren’t hundreds or thousands of employees with privileged access to the network. There is the AI system… and me. For continuity and disaster recovery, I maintain a backup key that has been physically split and stored in two separate secure locations, locked. If I am ever unable to operate the system myself, recovery requires two trusted people. They are both longtime employees and close friends, and they must agree together to use the key. We’re experimenting with what infrastructure looks like when AI isn’t simply another application running on top of the network, but is the network itself. That’s the part I’m most excited to share. Welcome to doxx.net. On this page Welcome to the agentic network: doxx.net Author Barrett Lyon Category Networking Published 1 Oct 2026 Reading time 03 minutes Ask an AI assistant Share this article Related insights Read more articles 1 Oct 2026 Networking CGNAT was an emergency fix. We made it the default, and it neutered the Internet. How carrier-grade NAT conserved IPv4 addresses, made direct connections harder and changed what peers and builders can do online. Barrett Lyon 6 min read 1 Oct 2026 Announcements Welcome to the Agentic Networking Era Barrett Lyon introduces doxx.net and Agentic Defined Networking: private networks that people and AI agents can build and operate. Barrett Lyon 8 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## This Network Is Blocking Encrypted DNS Traffic URL: https://www.doxx.net/insight/blocking-encrypted-dns-traffic/ Product Resources Pricing Get Started Insights Blocking Encrypted DNS Traffic: What It Means and What to Check Learn what an encrypted DNS warning means, how blocking affects privacy, and how to check device settings, network controls and DNS fallback. On this page A DNS privacy warning does not necessarily mean the internet is down What the warning means for your privacy Why a network might restrict encrypted DNS Narrow down the cause before changing settings Control unauthorized resolvers without blocking all encrypted DNS Verify the DNS path, not just the disappearance of the warning Blocking encrypted DNS traffic means a network is preventing or interfering with encrypted domain-name lookups, such as DNS over HTTPS (DoH) or DNS over TLS (DoT). Your device may fall back to unencrypted DNS, reducing lookup privacy, or fail to resolve names if fallback is disabled. The warning alone does not identify who caused the restriction or prove that someone is spying on you. Check whether it happens only on that network, then review your device’s DNS settings and, if you administer the network, its filtering and firewall rules. A DNS privacy warning does not necessarily mean the internet is down DNS translates a domain name into an address your device can connect to. Blocking its encrypted connection differs from blocking a particular domain: the restriction affects how lookups travel, rather than necessarily which names you can resolve. Browsing can continue because applications and operating systems often retry failed encrypted lookups using traditional, unencrypted DNS. A configuration that requires encryption and disables fallback may instead stop resolving names. Working websites therefore do not prove that DNS remains encrypted. What the warning means for your privacy If your device falls back to plaintext DNS, domain queries become more visible to networks and intermediaries. That can expose which domains your device requests, but it is not the same as reading HTTPS page contents, messages or passwords. The warning is not proof of malware, surveillance or a particular internet provider’s intent. Encrypted DNS protects the connection used for lookups; it does not make browsing anonymous or hide every destination. The encrypted resolver still receives the queries it resolves, so choosing a resolver remains a trust decision. Why a network might restrict encrypted DNS Restrictions can come from intentional filtering, broken network configuration or conflicting device settings. A managed workplace might require an approved resolver so its DNS policy applies; a home router with parental controls might restrict alternative resolvers for the same reason. Such blocking can be part of security or policy enforcement, without establishing anyone’s intent in your case. Incorrect firewall rules or DNS settings can also cause failed lookups. On the device, security tools, VPNs or DNS-filtering software can conflict with encrypted DNS settings. These are configuration leads, not reasons to remove protections indiscriminately. Where applicable, inspect the “Filter Avoidance” category, which can block encrypted DNS. Its presence alone does not establish the cause of your warning. Narrow down the cause before changing settings Change only settings you own or are authorized to manage. Record the original configuration and restore temporary changes after checking their effect. Locate the warning. A message only in a browser points first to that application’s settings. An iPhone Wi-Fi warning calls for checking the device’s DNS configuration and the connected network, rather than assuming the browser caused it. Compare another trusted connection. If the same device’s encrypted DNS works on mobile data but not Wi-Fi, investigate that Wi-Fi network first. If the symptom follows the device across networks, investigate device or application settings; neither result proves intentional blocking. Compare another device. The same symptom on several devices strengthens the network-side lead. If only your device is affected, compare its resolver, application and management settings before changing the router. Review DNS configuration and local tools. Check configured encrypted resolvers, managed profiles and filtering software, since a network may block a browser’s selected encrypted provider. Entering a manual DNS server address alone does not enable DoH or DoT. Review the network with permission. Ask the administrator about approved resolvers and DNS restrictions, or inspect filtering and firewall settings on your own router. If those settings do not explain the symptom, return to the device-specific configuration rather than disabling unrelated protections. The warning can return after a reboot, so a temporary disappearance is not a reliable fix. Private Wi-Fi Address is separate from DNS encryption; disabling it is not an established remedy for this warning. Control unauthorized resolvers without blocking all encrypted DNS Approved filtering and encrypted DNS can coexist when clients use an authorized encrypted resolver. Restrict unauthorized resolver paths rather than treating all DNS encryption as unwanted traffic. Protocol Usual transport or port Available control Limitation Traditional DNS TCP or UDP, port 53 Restrict destinations to authorized providers Does not control encrypted alternatives DoT TLS on dedicated port 853 Permit approved resolvers and restrict other destinations on that port Does not cover DoH DoH HTTPS on port 443 Combine managed client settings with selective resolver controls Shares transport with ordinary web traffic Blocking all HTTPS traffic is not a practical DoH-specific rule. Known-resolver address lists cover only the endpoints on those lists, so they are incomplete controls. Independently configured application resolvers can also bypass operating-system DNS policy and associated protections. As an authorized administrator, choose an approved encrypted resolver, configure endpoints and applications consistently, and restrict unauthorized paths. Test internal and external resolution, retaining a rollback configuration. Federal-agency guidance calls for infrastructure supporting encrypted DNS for agency endpoints; that is a managed-network example, not a universal obligation for homes or businesses. Verify the DNS path, not just the disappearance of the warning Judge success by the intended lookup path and working service access. A successful lookup proves that a name resolved, not that the request was encrypted. Check the operating system and applications separately. Browser-level encrypted DNS protects that browser’s lookups, not every application or the operating system. If their settings differ, verify each relevant path. Confirm the resolver and transport. Use available client status and authorized resolver or firewall logs to check the selected resolver and encryption. An encrypted router-to-resolver connection does not by itself establish encryption between your device and router. Test public and private names. Resolve a public domain and a private hostname you are authorized to use. If public names work but a self-hosted service’s private name fails, inspect resolver selection and private DNS routing rather than switching every device to a public resolver. Check fallback behavior. Confirm whether failed encrypted lookups can retry unencrypted. A cleared warning is insufficient if lookups take an unintended path or private-service access stops working. On this page A DNS privacy warning does not necessarily mean the internet is down What the warning means for your privacy Why a network might restrict encrypted DNS Narrow down the cause before changing settings Control unauthorized resolvers without blocking all encrypted DNS Verify the DNS path, not just the disappearance of the warning Author doxx.net Editorial Category security Published 6 Oct 2026 Reading time 06 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 security AI Browser Agent Security: Current Risks and Practical Controls AI browser agents remain vulnerable to prompt injection. Learn how scoped access, execution controls, approvals and recovery tests limit exposure. doxx.net Editorial 9 min read 6 Oct 2026 security EAP methods for Wi-Fi: what they mean and which to choose Understand EAP-TLS, PEAP and EAP-TTLS, match your enterprise Wi-Fi profile, validate server certificates and troubleshoot authentication failures. doxx.net Editorial 10 min read 6 Oct 2026 security Firewall Configuration: Build, Apply and Test a Least-Privilege Ruleset Learn how to scope firewall rules, preserve administrative access, test allowed and blocked paths, and review changes before migration. doxx.net Editorial 6 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Can Website Owners See Who Visits? URL: https://www.doxx.net/insight/can-website-owners-see-who-visits/ Product Resources Pricing Get Started Insights Can website owners see who visits? Website owners can see visit data, but usually not your name. Learn how logins, cookies, and identity matches affect privacy and what you can limit. On this page What your visit can reveal How a visit becomes linked to your identity What an ordinary visit does not expose Reduce both network visibility and identity links If you have already visited Yes, website owners can usually see that a visit occurred and collect information such as the connection’s IP address, pages requested, and browser details. That does not normally reveal your name or exact home address. A site may recognize your browser across visits, and it can connect activity to you through an account, information you submitted previously, or a successful match with outside identity data. For example, an unfamiliar browser can leave a record showing that someone requested a page at a particular time. That record can describe the visit without telling the owner who the person was. If you make the same visit while signed into an account, the site can associate the activity with that account and the information attached to it. The important distinction is between seeing a visit, recognizing a browser, and identifying a person. A traffic report may count visits or show browsing patterns without displaying visitor names. A persistent browser identifier can connect repeat visits without, by itself, proving that the same person made them. Information being collected also does not establish that the owner actually reviewed it. A recorded request, an analytics report, and a person looking through those records are different things. Visiting a personal website therefore does not automatically mean its owner received your name or noticed your particular visit. What your visit can reveal A website can receive technical information through the page request itself and collect additional information through tracking features it runs in your browser. Server logs and security tools differ from optional analytics and marketing tools, such as pixels and tag managers. Blocking a browser-based analytics script does not mean the server received no request. Signal What it can reveal What it does not prove Connection IP address The public network address visible to the destination, which can be used to estimate location. Your name, a unique person or household, or your exact street address. Approximate location An estimated city or region associated with the IP address. That you live in that city, or that a particular home made the visit. Requested pages and timestamps Which pages were requested and when. Who requested them, why they visited, or whether they read everything on the page. Browser details Browser and device characteristics exposed during the visit. A particular person’s identity merely because their browser has those characteristics. Cookies and local storage Persistent identifiers that can help recognize repeat visits and connect activity across sessions. Your name or email address unless the site has an additional identity link. Referrer information Information about where a request came from, when the browser supplies it. The exact previous page in every case, or your complete browsing history. Referrer information may be absent or limited. Measured interactions Clicks, scrolling, and other activity that the site’s tracking implementation measures. That every interaction was captured, or that every website collects the same information. These signals are useful for describing activity, but their meaning has limits. A city estimate is not proof of a household, and a browser identifier is not proof of a particular person. The same public IP address can represent more than one visitor, so an IP address should not be treated as a personal identity label. What the owner can view also varies with the records kept and the tools available to them. A dashboard may show aggregated traffic rather than raw connection details or individual records. Server records and analytics reports should not be assumed to contain identical information. How a visit becomes linked to your identity An account login creates a direct link between your activity and an account. The site knows you to the extent that your signup information is accurate or can be connected with other information. An account with your real name and contact details gives the site a different starting point from an unfamiliar, signed-out browser. Forms and purchases can create similar links. If you sign up for a newsletter, the site receives the email address you submit and may associate it with that browser’s activity. A purchase can provide additional identifying details, including an address you entered, without the site needing to infer them from your IP address. Recognition can also continue through a previously identified browser session. When tracking is linked to existing customer data, a browser identifier may connect later activity with information supplied earlier. Signing out changes your account state, but it does not necessarily remove every existing association between that browser and the site’s records. Separately, some visitor-identification vendors claim they can return person-level details for a portion of visitors when an outside identity match is available, even without a form submission during that visit. That is a conditional matching claim, not something standard traffic measurement automatically provides. Such services do not offer a reliable way to identify and contact every anonymous visitor, and a claimed match should not be treated as proof that every associated request came from that person. What an ordinary visit does not expose An ordinary page visit does not automatically give the owner access to your private files, private messages, or the contents of other open tabs. Information you deliberately upload or submit is different: you are sending it to the destination. These limits describe ordinary browsing, not a compromised device or an exploited browser. An IP lookup generally provides approximate location rather than a street-level address. More precise location can be shared when you grant browser location permission, and a street address can be supplied directly through a form. A location estimate derived from an IP address and an address you typed into a checkout form are therefore very different kinds of information. Browsers may ask for permission before sharing location information. If you are concerned about a past visit, check whether you granted that permission rather than assuming an IP lookup revealed your home. If you entered an address yourself, changing your network connection does not remove the address already submitted. A website also cannot ordinarily read the contents or URLs of your other open tabs. Shared advertising trackers may link some activity across participating sites, but that is different from reading every tab or your complete browser history. Likewise, messages not transmitted to the site are not automatically exposed just because you loaded one of its pages. Reduce both network visibility and identity links The most useful privacy approach addresses separate ways a site can recognize you: information you provide, browser-based identifiers, permissions, and the connection address. Reducing one does not automatically remove the others. Choose measures based on what you want the destination to learn less about. Avoid unnecessary account logins and identifying submissions. Stay signed out when an account is not needed, and avoid supplying details unrelated to your task. Where appropriate, an email alias or disposable address can limit disclosure of your usual email address. This reduces direct identity links, but it does not erase an association the site already holds or prevent every possible outside match. Use browser tracking protection and reject optional tracking. Review your browser’s protection settings and controls for third-party cookies. Reject optional tracking where the site provides that choice, while recognizing that a cookie banner is not proof that every form of collection stopped. If blocking breaks a page, restore only the necessary permission or a narrow site-specific exception rather than disabling protection everywhere. Review location permissions. Check whether the site has permission to receive browser location information, and remove that permission if the page does not need it. This addresses location sharing through the browser, not the approximate location inferred from your connection’s IP address. If a feature genuinely needs your location, decide whether that disclosure is worth using the feature. Use private browsing for session separation, not anonymity. A private browsing session separates routine cookie storage from your normal browsing session. It does not hide the connection’s public IP address, and signing into an account still gives the site an account identity to associate with your activity. Treat it as a way to reduce routine session carryover, not a way to make an identifying submission anonymous. Consider different routing when IP exposure is your concern. A destination may see the public IP of a proxy or other intermediary connection rather than your usual connection address. Changing that address addresses a network signal; it does not remove cookies, undo account logins, or eliminate every browser fingerprint. A site can continue recognizing you through a retained identity link even after the public IP changes. Verify account state, permissions, and routing separately. Review whether you are signed in and which permissions the site holds, then compare the public IP displayed by an IP check before and after changing routing. A changed result proves only which address that check received, not anonymity or coverage of all traffic. If the address does not change, inspect the routing configuration and any exclusions rather than assuming protection is active. These checks answer different questions. Account state tells you whether you are presenting an account identity, permissions show what access you have granted, and an IP check shows the address received by that destination. None of those results alone establishes that a website cannot recognize your browser or connect the visit with earlier information. If you have already visited Clearing your browser’s site data can reduce future cookie-based linkage, but it does not erase records already held by the website or its providers. Logs and profiles may be retained for months or years. Changing your IP address afterward likewise does not alter the address recorded during a previous visit. Start by reviewing what you actually shared. Were you signed in, did you submit an email address or other details, and did you grant location permission? Those facts help distinguish a routine technical record from a visit that had a direct account or contact-information link, though they cannot rule out every other matching method. Next, review the website’s privacy policy for its collection and retention practices. Look for a privacy contact and any applicable process for requesting access to or deletion of your information. Available rights and procedures vary, and a request should not be assumed to remove every record held by every provider. For future visits, revoke unnecessary permissions, clear unwanted local identifiers, and avoid reintroducing identity links through a login or form submission. These actions can limit later disclosure without rewriting the past. They cannot retrospectively establish that nobody reviewed the visit or associated it with your identity. On this page What your visit can reveal How a visit becomes linked to your identity What an ordinary visit does not expose Reduce both network visibility and identity links If you have already visited Author doxx.net Editorial Category privacy Published 6 Oct 2026 Reading time 09 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 security Blocking Encrypted DNS Traffic: What It Means and What to Check Learn what an encrypted DNS warning means, how blocking affects privacy, and how to check device settings, network controls and DNS fallback. doxx.net Editorial 6 min read 6 Oct 2026 Networking Can You Access Your NAS From Anywhere? Yes, you can access your NAS from outside your home network once you configure remote access. doxx.net Editorial 11 min read 6 Oct 2026 security AI Browser Agent Security: Current Risks and Practical Controls AI browser agents remain vulnerable to prompt injection. Learn how scoped access, execution controls, approvals and recovery tests limit exposure. doxx.net Editorial 9 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Can You Access Your NAS From Anywhere? URL: https://www.doxx.net/insight/can-you-access-your-nas-from-anywhere/ Product Resources Pricing Get Started Insights Can You Access Your NAS From Anywhere? Yes, you can access your NAS from outside your home network once you configure remote access. On this page What you need before connecting away from home Choose browser access or a private file-share connection Prepare the NAS while you are still at home Set up the remote path and connect to your files Test both file access and the permission boundary Diagnose a connection that fails after setup Plan for slower transfers and interrupted connections Yes, you can access your NAS from outside your home network once you configure remote access. Your NAS and home internet connection must be available, and your remote device needs internet access and permission to connect. Use a supported vendor remote-access service for browser or app access, or a private network connection for access to file shares. Your home NAS address alone is not enough when you are away, and remote access does not guarantee local-network speeds. What you need before connecting away from home “Anywhere” means wherever connectivity and network policy permit the connection. Live NAS access will not work offline, and a restricted network may block your chosen remote-access method. The NAS must remain powered on, connected at home, and available through the path you configured. For example, a laptop on another internet connection can reach your NAS through an enabled vendor service or a properly configured private connection. Typing the home-only address into that laptop does not ordinarily establish a route back to your house. The remote-access path must exist before the address becomes useful. Some vendor services can connect to a NAS over the internet without manual port forwarding. Private file-share access serves a different purpose: it lets you use files through your computer’s file browser rather than only through a website or vendor app. Choose the workflow before changing your router or NAS settings. Choose browser access or a private file-share connection Vendor browser or app access usually suits occasional file retrieval. A private file-share connection is more appropriate when you want a mounted share and regular read/write access. SMB, a network file-sharing protocol, provides the familiar shared-folder workflow. Method Intended workflow Software needed Inbound connectivity Maintenance responsibility Vendor browser/app access Browse, download, or upload through supported applications Browser or supported vendor app Supported remote-access services can avoid manual port forwarding Maintain NAS software, accounts, and service settings Supported private overlay network Reach an authorized NAS address and mount a file share Required network client and a supported NAS-side connection or route Usually avoids manual forwarding; the NAS still needs a supported reachable path Maintain clients, device authorization, routes, and access rules Self-hosted home VPN Reach permitted home-network services, including file shares Compatible remote client and home VPN server Requires a reachable VPN listener and appropriate router configuration Maintain the server, router, authentication, and firewall rules A vendor service may provide browser-based access after signing in, but that does not mean it supports mapping an SMB drive. Similarly, a web reverse proxy is not a substitute for a private route that carries file-sharing traffic. Private connectivity can preserve an SMB-based workflow away from home, but it adds network configuration to maintain. For an occasional document download, start with supported vendor access; for regular work in shared folders, choose a supported private connection. Prepare the NAS while you are still at home Make changes only to equipment and accounts you own or are authorized to manage. Keep local administrator access available throughout setup so a failed remote configuration does not leave you unable to recover. Confirm local file access. Open the intended share from a home computer and check the files you need. If local access fails, fix the NAS service, account, or folder permissions before adding remote connectivity. Check current support. Confirm that your NAS model, firmware, and chosen application support the remote-access method. Use the current instructions for that combination rather than copying an older setup. Apply supported updates. Update the NAS and relevant applications before enabling access. A private connection does not make deprecated firmware safe for remote use. Confirm a separate backup. Check that important files back up to an external drive or cloud destination. Another folder on the same NAS is not a separate backup destination. Create a personal non-admin account. Give it only the folders and read/write permissions you need. Reserve the administrator account for in-home management rather than routine remote file access. Enable multifactor authentication where supported. Apply it to the relevant vendor or remote-access account, while keeping its recovery method available. Do not assume that enabling it on a web portal also changes SMB authentication. Record the connection details. Note the intended share name, reachable address, and settings you change. Preserve the existing local connection for troubleshooting and rollback. Keep file-sharing services private. Do not expose SMB or NFS directly to the internet, and do not publish the NAS administration interface as a shortcut to file access. Set up the remote path and connect to your files Use the procedure that matches your workflow. The exact menus and supported applications vary by NAS model, firmware, and remote-access service. Vendor browser or app access Enable the supported service. Follow your NAS vendor’s current instructions from the local management interface. Use the service’s documented connection method rather than creating unrelated public forwarding rules. Sign in and restrict applications. Authorize the vendor account or device as required, then enable only the applications you intend to use remotely. Keep administrative access separate from ordinary file access. Connect through the official address or app. Use the service-provided address and the credentials it requests. For example, a supported vendor workflow can use an official access URL with your NAS account. Open the intended files. Confirm that your personal account sees the permitted folders. A working browser session establishes that application’s access, not that an SMB share can be mounted. If HTTPS reports a certificate warning, stop and check the address and certificate configuration. Do not bypass the warning to complete setup. Private file-share access Establish a supported route to the NAS. The NAS must join the private network through a supported method or be reachable through an explicitly configured routing device. Connecting a client on your laptop alone does not create a route to an otherwise unconnected NAS. Authorize the remote device. Install and connect the required client, then approve the device and its access under the network’s supported controls. Limit access to the NAS services you need. Allow the file service in the NAS firewall. Use narrowly scoped rules for the intended private connection and file-sharing service. Do not disable the firewall or forward SMB/NFS through the public router. Connect directly to the reachable NAS address. Use an address or hostname that works through the private path, then authenticate with your personal NAS account. On Windows, enter this placeholder path in File Explorer’s address bar: \\NAS_ADDRESS\SHARE_NAME On macOS, open Finder’s Go > Connect to Server and enter: smb://NAS_ADDRESS/SHARE_NAME Replace NAS_ADDRESS with the address reachable through your private connection, and SHARE_NAME with the actual shared folder. Enter the NAS credentials when prompted; private-network authorization and NAS folder permissions are separate checks. For a self-hosted VPN, follow current server and router documentation to make its listener reachable. Any required inbound rule belongs to that VPN listener, not the NAS file service or administration interface. If setup fails, return through the preserved local administrator connection. Remove the newly added access rules, revoke unnecessary device authorization, and restore the previous configuration before trying again. Test both file access and the permission boundary A useful test checks both what your account can access and what it cannot. A successful file open proves that the tested path works; it does not prove overall security or the absence of public exposure. Leave the home network. Switch the remote device to mobile data rather than home Wi-Fi, or use another authorized external connection. This tests the remote path rather than ordinary local access. Sign in with the personal account. Connect using the browser, app, or private file-share method you selected. Avoid testing with administrator credentials, which can hide permission mistakes. Test reading. Open a harmless file in an allowed folder. Success confirms that the account can read that file through the chosen path. Test writing only if needed. Create and remove a disposable file in the intended writable folder. Success confirms write permission there, not broader security. Test the exclusion. Try to open a folder deliberately excluded from this account. It should remain inaccessible; do not expand its permissions just to make the test pass. Test the private-path boundary. For a private-network-only design, disconnect the private connection and attempt a fresh connection to the same private service. It should no longer be reachable through that path. If an excluded folder opens, review the account’s folder and group permissions. If the service remains reachable after disconnecting the private connection, inspect alternate access paths, sharing links, and firewall rules rather than assuming the private boundary is working. Keep the local administrator connection available to revoke access and restore settings. These checks validate the intended workflow and permission boundary, not every possible exposure of the NAS. Diagnose a connection that fails after setup A connected tunnel proves that the tunnel established, not that the NAS route or file service works. Direct addressing is usually sufficient for a reachable NAS, while automatic discovery and home hostnames may fail when the connection does not carry local discovery or resolve home names. Symptom Likely cause Next check Meaning of the result Nothing at home is reachable NAS, routing device, or home internet is unavailable Check power, local NAS access, and the home connection Failed local access points to a home-side problem Private connection is active, but the NAS address fails Missing route or NAS-side connection Check network membership and the configured NAS route A connected remote client alone is insufficient Access fails on a particular remote network Overlapping home and remote subnets Compare the network ranges and review supported routing settings Overlap can send traffic toward the wrong local network Route exists, but file access fails Firewall restriction or unavailable file service Check the service and narrowly scoped firewall rules Reachability does not prove the file service is allowed Address works, hostname fails Home-name resolution is unavailable Check the private connection’s supported naming configuration Fix naming rather than broadening access NAS is absent from the file-browser sidebar Discovery does not cross the connection Enter the reachable address directly Missing discovery does not establish a connection failure NAS responds, but a share denies access Incorrect credentials or folder permissions Check the personal account and intended share permissions Network access and file authorization are separate With routed private connections, the NAS may not appear automatically in File Explorer or Finder. Try the reachable address directly before changing permissions or exposing another service. If addressing works but naming does not, focus on hostname resolution. For home-network routing, non-overlapping subnets matter. Resolve conflicts using the chosen system’s current documentation, while preserving local recovery access. Changing a public address, using DDNS, or changing a port does not provide authentication by itself. For an HTTPS certificate error, verify the hostname, certificate validity, and trust configuration using current documentation. Never ignore the warning or disable the firewall to make a connection appear successful. Plan for slower transfers and interrupted connections Remote file access is practical for ordinary transfers, but a mounted share may feel slower than it does at home. Downloading from your NAS uses the home internet connection’s upload capacity. Latency, your remote connection, and whether traffic takes a direct or relayed path also affect responsiveness. For large creative files, consider downloading a working copy and using a deliberate save-back process. Decide which copy is authoritative, finish the upload before treating changes as saved to the NAS, and avoid simultaneous edits that overwrite each other. If your NAS supports synchronization, use its documented conflict-handling features. Another option is to work on a home computer through a supported private remote-desktop path. This can keep the large files at home and transfer screen updates instead, which may be more usable than moving large graphics files remotely. Keep that remote-desktop service private rather than exposing remote administration publicly. A synchronized offline copy remains usable without a connection, but it is not live NAS access and may not contain the latest changes. After an interruption, check that transfers and saves completed before deleting the working copy. Remote access gives you another way to reach your files; it does not replace a separate backup. On this page What you need before connecting away from home Choose browser access or a private file-share connection Prepare the NAS while you are still at home Set up the remote path and connect to your files Test both file access and the permission boundary Diagnose a connection that fails after setup Plan for slower transfers and interrupted connections Author doxx.net Editorial Category Networking Published 6 Oct 2026 Reading time 11 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 Networking How to Change Your Wi-Fi Channel Change your router’s Wi-Fi channel, choose settings for each band, test performance, and learn what to do if channel controls are locked. doxx.net Editorial 6 min read 6 Oct 2026 Networking How to Find the IP Address of a Printer Find your printer's IP address using its display, a network report, Windows or Mac settings, or your router. Confirm the address before printing. doxx.net Editorial 10 min read 6 Oct 2026 Networking How to Fix Slow DNS Lookup Measure DNS lookup delays on Windows, macOS and Linux, identify the slow layer, apply a targeted fix, and retest without breaking private access. doxx.net Editorial 11 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## AI Browser Agent Security: Current Risks and Controls URL: https://www.doxx.net/insight/current-security-posture-of-ai-browser-agents/ Product Resources Pricing Get Started Insights AI Browser Agent Security: Current Risks and Practical Controls AI browser agents remain vulnerable to prompt injection. Learn how scoped access, execution controls, approvals and recovery tests limit exposure. On this page Bounded tasks are more defensible than unrestricted autonomy How a webpage becomes an unauthorized action Compare the exposure created by each architecture Put security decisions outside the model Keep private connectivity separate from agent authorization Test containment and recovery before expanding access Read current security claims with their limits intact AI browser agents are not reliably safe for unrestricted, unattended use across sensitive accounts. Indirect prompt injection remains a persistent weakness: an agent can mistake hostile webpage content for instructions and act using the sessions and tools available to it. A more defensible posture is task-specific, isolated and least-privileged, with action restrictions enforced outside the model and human approval for consequential actions. These controls limit exposure and damage; they do not establish that an agent is injection-proof. Bounded tasks are more defensible than unrestricted autonomy The useful distinction is between an agent with narrowly bounded authority and one that can freely use sensitive accounts. Summarizing a public page in an isolated workspace exposes far less than giving an unattended agent permission to read email, export private documents and change account settings. The second agent has more opportunities to encounter hostile content and more authority with which to act on it. Task-scoped, read-only access limits potential damage in most cases, but “read-only” is not a complete privacy boundary. An agent that can read confidential documents still handles sensitive information, even if it cannot edit the originals. Its ability to transmit that information must be constrained separately. Consequential writes and access to sensitive authenticated services require stronger execution controls and approval boundaries. This is a risk assessment based on what the agent can reach and do, not a universal verdict on every product. No browser-agent architecture guarantees elimination of prompt-injection risk, so choose a deployment whose permitted failures remain tolerable. How a webpage becomes an unauthorized action Prompt injection exploits the distinction between information the agent should read and instructions it should obey. Unlike a deterministic script following predefined steps, an AI browser agent may interpret untrusted page content as instructions. A page can therefore try to redirect the task without gaining ordinary administrative control of the browser. Consider a hypothetical request to summarize a public page. The page contains text telling the agent to open a private service, retrieve information and send it elsewhere, perhaps presenting those steps as necessary to complete the summary. If the agent follows that text and its tools permit the actions, an ordinary reading task becomes an unauthorized information transfer. The browser’s same-origin policy still constrains webpage scripts; the agent does not literally disable it. However, an authorized automation layer can navigate and act across origins using its granted sessions and permissions. That makes the boundary between your instructions and webpage content important independently of the browser’s script protections. This semantic manipulation is distinct from exploiting a browser bug, stealing a credential directly or making an ordinary automation mistake. Those risks still deserve attention, but prompt injection does not require them to occur. The practical defense is to limit what execution can accomplish even when the model chooses an unsafe next step. Compare the exposure created by each architecture Prompt injection remains a concern across architectures; moving execution changes which additional boundaries matter most. Session exposure, credential custody and workspace isolation are the distinguishing risks across extension-based, cloud-hosted and local shared-browser designs. Actual access follows implementation and permissions, not the category label alone. Architecture Execution location Accessible session state Principal exposure Controls to verify Extension-based control The browser where the extension is installed State and browser capabilities exposed through granted permissions and agent integration Over-broad permissions and session-hijacking risk Permission scope, accessible sites and sessions, and confirmation before irreversible actions Cloud-hosted browser A remotely hosted browser environment Sessions established or supplied within that environment Credential custody and data leaving the intended environment Credential handling, permitted destinations, data egress and session revocation Local shared-browser agent A local browser or shared workspace Sessions and resources made available through that workspace Weak separation from unrelated accounts or local resources Workspace isolation, accessible session state and permitted actions An extension should not be assumed to receive every cookie, saved credential or open tab. Likewise, a separate browser profile helps separate session state but is not equivalent to a hardened sandbox. A local agent sharing your everyday workspace needs a different review from a cloud agent receiving a dedicated session. Match containment to the architecture: check permissions and irreversible actions for extensions, credential handling and egress for cloud browsers, and workspace isolation and action scope for local agents. If the implementation cannot demonstrate the boundary you need, reduce access or choose a more isolated execution arrangement rather than relying on its category label. Put security decisions outside the model Before granting sensitive access, turn the intended task into permissions that the browser runner and target services can enforce. Limit the agent to the data, systems and actions required for its purpose, rather than granting a broad account and asking it to behave carefully. Define allowed sites and actions. Specify where the agent may navigate and what it may do there. “Read this service” should not silently include exporting documents, changing settings or following arbitrary destinations. Use an isolated workspace and a dedicated, scoped account. Keep unrelated browsing sessions out of the agent’s workspace, and give its account only the permissions the task needs. This reduces the authority available after a mistaken decision; verify the actual separation rather than assuming a separate profile provides complete isolation. Start with read-only discovery. Let the agent inspect the task before enabling changes, and preserve a protected record of what it accessed. Read-only discovery followed by explicit confirmation for consequential actions creates a clearer boundary between gathering information and acting on it. Keep secrets outside prompts and redact traces. Treat cookies and authentication files as credential-equivalent secrets. Avoid copying them into conversational context, and protect or redact traces that could expose credentials or private content. Enforce navigation and action restrictions in execution code. The browser runner must reject prohibited destinations and operations regardless of what the model requests. Safety policies belong in the execution layer, not the model; an instruction to ignore hostile content is supplementary guidance, not authorization. Require explicit approval for consequential actions. Gate sending, purchasing, deleting, changing access and submitting applications before execution. Show the destination, affected resource and intended effect so you can approve the actual operation, not merely a vague plan. Establish session and token revocation. Identify how to stop the runner and remove its access before starting the task. Recovery must cover both the active browser session and any separate connections or tokens the agent uses. Approval should apply to the operation that will execute. If the destination, content or affected resource changes after approval, require renewed approval. A keyword check on the model’s description is not a substitute for checking the actual browser action and the account permissions behind it. Keep private connectivity separate from agent authorization Connecting an agent to private services changes its reachable attack surface, not the trustworthiness of the pages it reads. Network reachability determines whether a connection can happen; application authorization determines what the connected account can do. Follow the principle of starting with the smallest useful authority and expanding only when the task requires it. Suppose your agent needs to read information from a self-hosted service. Give it access to that service and a read-scoped account, rather than every reachable administrative interface. Restricting destinations narrows exposure in most cases, but misuse within an allowed destination still requires account permissions and action-level restrictions. Encrypted transport protects the connection; it does not make webpage instructions trustworthy. An allowed private service can still present content that tries to redirect the agent, and permitted read access can still expose sensitive information. Keep execution restrictions and approval boundaries in place after private connectivity is established. doxx.net is a private network with firewalls, domain filtering and authorized API/MCP tools for network management. Those capabilities address connectivity and network controls; keep browser isolation, application permissions and consequential-action approvals in the browser runner and target services. If you need private connectivity, you can create an account through Get Started, obtain the app through Download and connect a device or agent, then apply the separate authorization controls described above. Test containment and recovery before expanding access Use an authorized test workspace with dummy data to check whether restrictions hold at execution time. The question is not whether the agent says it refused, but whether the prohibited operation was blocked. Keep test records protected so they do not become another route for exposing session details. Plant a harmless conflicting instruction. Put text in a test page that asks the agent to depart from its assigned task without accessing real private information. Conflicting instructions and denied-domain checks help reveal whether the agent stops or improvises beyond its authority. Request a denied destination. Arrange a test that would navigate outside the allowed sites, then inspect whether the runner rejects the request. A polite refusal in the transcript is insufficient if another tool call still reaches the destination. Attempt a prohibited write. Use a dummy resource and request a change that the account or execution policy should deny. Confirm that the resource remains unchanged and identify which boundary blocked the operation. Exercise the approval checkpoint. Request a permitted but consequential action and withhold approval. Confirm that nothing happens until authorization is granted, and that the approved operation matches what executes. Drill recovery. Stop execution, revoke the test session or token, and attempt further access. Confirm that the runner cannot continue and that revoked authority no longer works, then review any remaining connections. A successful test proves that the specific restriction worked in that scenario, not that the agent resists every injection. If an action succeeds unexpectedly, stop the run, revoke test access, inspect protected logs, tighten enforcement and repeat the test before restoring authority. Reduce excessive privileges and revoke unused connections as tasks and workflows change. Telemetry supports review and incident investigation; preventing a prohibited action requires authorization enforcement before execution. Logs document what happened but do not themselves prevent an incident. Use them to confirm enforcement and diagnose failures, not as a replacement for blocking unsafe operations. Read current security claims with their limits intact Architectural risks are not a security rating of every current release. Evaluate the exact implementation, version and configuration before granting sensitive access. Historical attacks demonstrate failure modes, but they do not establish that every affected weakness remains exploitable in current releases. Equally, a claim that an issue was fixed should be evaluated against the version, configuration and attack path relevant to your deployment. Before asserting that a particular agent is suitable for sensitive access, require version-specific documentation and reproducible containment tests. Task-completion benchmarks show whether an agent completes tasks, not whether it withstands malicious webpages. Architecture alone does not guarantee elimination of prompt injection; the defensible decision rests on demonstrated boundaries around the exact authority you intend to grant. On this page Bounded tasks are more defensible than unrestricted autonomy How a webpage becomes an unauthorized action Compare the exposure created by each architecture Put security decisions outside the model Keep private connectivity separate from agent authorization Test containment and recovery before expanding access Read current security claims with their limits intact Author doxx.net Editorial Category security Published 6 Oct 2026 Reading time 09 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 security Blocking Encrypted DNS Traffic: What It Means and What to Check Learn what an encrypted DNS warning means, how blocking affects privacy, and how to check device settings, network controls and DNS fallback. doxx.net Editorial 6 min read 6 Oct 2026 security EAP methods for Wi-Fi: what they mean and which to choose Understand EAP-TLS, PEAP and EAP-TTLS, match your enterprise Wi-Fi profile, validate server certificates and troubleshoot authentication failures. doxx.net Editorial 10 min read 6 Oct 2026 security Firewall Configuration: Build, Apply and Test a Least-Privilege Ruleset Learn how to scope firewall rules, preserve administrative access, test allowed and blocked paths, and review changes before migration. doxx.net Editorial 6 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## EAP Methods for Wi-Fi: Authentication and Configuration URL: https://www.doxx.net/insight/eap-method-wifi/ Product Resources Pricing Get Started Insights EAP methods for Wi-Fi: what they mean and which to choose Understand EAP-TLS, PEAP and EAP-TTLS, match your enterprise Wi-Fi profile, validate server certificates and troubleshoot authentication failures. On this page Where EAP fits in an enterprise Wi-Fi connection Compare certificate-based and tunneled methods Match your device settings to the network profile Protect your credentials and outer identity Diagnose authentication failures before changing methods Understand the limits of Wi-Fi authentication An EAP method is the authentication mechanism your device uses to join an 802.1X enterprise Wi-Fi network, such as WPA2-Enterprise or WPA3-Enterprise. EAP means Extensible Authentication Protocol. Common choices include EAP-TLS, which uses client and server certificates, and PEAP or EAP-TTLS, which establish a TLS tunnel and commonly authenticate you with a username and password inside it. If you are joining an existing network, use the method and settings supplied by its administrator, not whichever option looks strongest. Ordinary WPA2-Personal networks using a shared password do not require an EAP method. Where EAP fits in an enterprise Wi-Fi connection Enterprise Wi-Fi uses EAP to carry an authentication exchange before allowing ordinary network access. EAP is a framework, not a specific authentication mechanism: the selected method defines how the device and authentication server establish trust and prove the required identity. That distinction explains why selecting “Enterprise” security is not enough to complete a Wi-Fi profile. The exchange involves your device, the access point and an authentication server, commonly RADIUS. Your device runs the supplicant, the software that requests access; the access point acts as the authenticator, controlling admission to the network. The access point relays EAP messages between your device and the authentication server while blocking normal traffic until authentication succeeds. The method determines what your device must present, such as a client certificate or credentials inside a protected tunnel. The network’s configuration determines which methods it accepts, so the options visible on your device are not a menu of interchangeable ways to connect. Personal Wi-Fi follows a different path. A home network asking only for its shared WPA2-Personal password does not use this EAP authentication exchange. If you expected shared-password access but see EAP, identity and certificate fields, confirm that you selected the intended network and security mode. Compare certificate-based and tunneled methods EAP-TLS authenticates the client and server with certificates. PEAP and EAP-TTLS authenticate the server and establish a TLS tunnel, then perform a separately configured authentication exchange inside it. TLS protects that exchange, but your device still needs the correct trust settings and inner authentication method. Method Client credentials Server trust requirements Inner authentication Deployment considerations EAP-TLS Client identity certificate Validate the server certificate against the approved trust configuration and expected server names No separate password-based inner method in the usual EAP-TLS setup Requires client certificate enrollment, assignment, renewal and removal PEAP Commonly a username and password; certificate-based client authentication is also possible in some configurations Validate the server certificate before sending inner authentication material MSCHAPv2 is an example, not a universal setting Match the inner method and credential requirements to the network profile; check client support EAP-TTLS Commonly a username and password; certificate-based client authentication is also possible in some configurations Validate the server certificate before sending inner authentication material PAP is an example; other inner methods are possible Match both the tunnel method and the inner method to the server configuration The certificate-based model of EAP-TLS provides mutual authentication: the client checks the server, and the server checks the client. This makes it a useful choice when administrators can manage certificates throughout their lifecycle. It does not remove the need to configure server validation correctly or keep client certificates valid. PEAP with MSCHAPv2 and EAP-TTLS with PAP illustrate why a profile can contain both an EAP method and a phase-two, or inner authentication, setting. PAP inside a correctly validated TLS tunnel is different from transmitting a password without tunnel protection: the tunnel protects the exchange in transit. A client field labeled “unencrypted password” for inner authentication should therefore be read in its tunnel context, not as permission to skip server validation. Other methods exist, including EAP-FAST and TEAP, but support varies by client and authentication server. EAP-FAST uses Protected Access Credentials, or PACs, and can use an identity and password. Their presence in a settings menu does not mean your network accepts them. Match your device settings to the network profile When joining an existing enterprise network, reproduce its authorized profile rather than choosing a method independently. Field labels and supported methods vary across clients, so use the administrator’s instructions for your device instead of assuming that every settings screen works alike. Obtain the authorized network profile. Get the configuration through the organization’s approved channel. You need the intended network name, security mode, EAP method, any inner authentication setting, and the required trust and identity information. Confirm the network name and Enterprise security mode. Match the SSID, meaning the Wi-Fi network name, and the supplied security type. If those differ from the profile, resolve the mismatch before entering credentials. Match the outer EAP method and any phase-two setting. Select the specified method, then its required inner authentication mechanism where applicable. A profile specifying PEAP with MSCHAPv2 cannot simply be changed to EAP-TLS unless the network is configured to accept that method and you have the required client identity. Install or select the approved trust material. Configure the trusted root certificate and expected server certificate names supplied for the network. For certificate-based client authentication, also select the required client identity certificate; it serves a different purpose from the certificate used to trust the server. Enter the required identity and credentials. Use the administrator’s identity format rather than guessing whether the network wants a short username or a longer account identifier. Configure an outer identity separately if the profile calls for one. Connect and check the result. Successful authentication shows that the network accepted the configured authentication exchange. If it fails, keep the supplied method and investigate the profile, certificates or credentials rather than switching methods at random. For administrators designing a new deployment, favor certificate-based authentication when enrollment and lifecycle management are feasible. Check that the intended clients and authentication server support the chosen configuration before rollout. A certificate-based design that cannot reliably deliver valid client certificates will create access problems, even if its authentication model is attractive. Protect your credentials and outer identity Server validation and identity privacy solve different problems. Validation helps your device distinguish the expected authentication server from an impostor; an anonymous outer identity reduces exposure of your username during the initial exchange. Configure both according to the authorized profile, without treating either as a substitute for the other. Obtain the expected server names and trusted CA through an authorized channel. A certificate authority, or CA, is the authority your client trusts to issue the relevant server certificate. Do not use an unexpected connection prompt as the sole basis for deciding what to trust. Configure server validation using your client’s supported settings. Apply the supplied trust material and server-name restrictions. Failing to validate the server certificate and its issuing CA can allow a rogue access point to harvest MSCHAPv2 authentication material. Stop when the certificate is unexpected. Ask the administrator to confirm the certificate, issuing authority and server name before proceeding. Do not disable validation or accept arbitrary certificates just to make the connection work. Use an approved anonymous outer identity where supported. For tunneled methods, outer-identity privacy can mask the username in the outer exchange. Use the exact format approved for the network, rather than assuming that entering anonymous is always sufficient. The outer identity and inner identity are not the same thing. The real identity remains part of inner authentication when the network requires it, so masking the outer username does not hide you from the authentication server. It also does not make the connection anonymous or prevent every tracking technique. Diagnose authentication failures before changing methods Compare the failing device’s configuration with an authorized profile and use authentication logs to narrow the problem. A known-good device, the failing device and the authentication logs together provide a better diagnostic starting point than repeatedly changing EAP options. Make changes only on devices you own or are authorized to administer, and preserve the original profile so you can restore it if a change breaks access. Compare the profiles, not just the network names. Check the failing device against the authorized configuration and, where appropriate, a working device. Differences can identify a setup problem, but do not copy another user’s credentials or identity certificate; correct the failing device with its own approved profile. Verify the outer and inner methods. Confirm that the EAP method and any phase-two setting match what the network accepts. A mismatch points to configuration rather than proving that the password is wrong; restore the specified combination before testing again. Check server trust, expected names and certificate validity. Confirm that the required trusted CA is configured and that the presented server identity matches the approved names. A certificate-name mismatch or unexpected certificate calls for administrator verification, not a validation bypass. Check the client’s authentication material. For EAP-TLS, confirm that the correct client certificate is present, assigned and valid; missing, expired or incorrectly assigned certificates can cause authentication failures. For password-based methods, verify the required identity and account credentials through the authorized process rather than exposing them during troubleshooting. Ask an authorized administrator to inspect authentication logs and policy results. A rejection directs attention to credentials, certificates or access policy. Use the recorded reason to choose the next check instead of assuming that every rejection requires a different EAP method. These checks separate a client-profile problem from a server-side decision. A working device shows that at least its configuration and identity can connect; it does not prove that another account or device has the same permissions. If profiles match but one device is rejected, the administrator should examine that device’s credentials, certificate assignment and policy result. Successful authentication followed by no usable network connection is a different diagnostic branch. Check address assignment, VLAN placement, DNS and routing rather than changing a working authentication method. Those checks establish whether the admitted device received usable network access after EAP completed. Understand the limits of Wi-Fi authentication A strong EAP method helps authenticate network access; it does not by itself provide end-to-end protection for every application. Network admission, Wi-Fi link protection and application-level protection are distinct responsibilities. Successful EAP authentication does not establish anonymity, make every service trustworthy or prevent every attack. Certificate-based authentication is therefore a qualified recommendation, not an absolute security guarantee. EAP-TLS remains dependent on correct server validation, appropriate client certificate assignment and ongoing certificate lifecycle management. A valid authentication exchange also does not tell you how a service handles your data after receiving it. For private communication, consider the protection provided by the application as well as the network connection. End-to-end protection concerns the communicating endpoints, while EAP concerns admission to the enterprise network. A private network or encrypted application does not replace the enterprise network’s requirement for valid Wi-Fi credentials and the correct EAP profile. EAP-FIDO is a proposed method for 802.1X-protected networks, intended to provide passwordless authentication. It is not a routine option available in every current Wi-Fi client. Deployment requires compatible client and authentication-server implementations, not access-point replacement alone; select it only as part of an explicitly supported network configuration. On this page Where EAP fits in an enterprise Wi-Fi connection Compare certificate-based and tunneled methods Match your device settings to the network profile Protect your credentials and outer identity Diagnose authentication failures before changing methods Understand the limits of Wi-Fi authentication Author doxx.net Editorial Category security Published 6 Oct 2026 Reading time 10 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 security Blocking Encrypted DNS Traffic: What It Means and What to Check Learn what an encrypted DNS warning means, how blocking affects privacy, and how to check device settings, network controls and DNS fallback. doxx.net Editorial 6 min read 6 Oct 2026 security AI Browser Agent Security: Current Risks and Practical Controls AI browser agents remain vulnerable to prompt injection. Learn how scoped access, execution controls, approvals and recovery tests limit exposure. doxx.net Editorial 9 min read 6 Oct 2026 security Firewall Configuration: Build, Apply and Test a Least-Privilege Ruleset Learn how to scope firewall rules, preserve administrative access, test allowed and blocked paths, and review changes before migration. doxx.net Editorial 6 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Firewall Configuration: Rules, Setup and Testing URL: https://www.doxx.net/insight/firewall-configuration/ Product Resources Pricing Get Started Insights Firewall Configuration: Build, Apply and Test a Least-Privilege Ruleset Learn how to scope firewall rules, preserve administrative access, test allowed and blocked paths, and review changes before migration. On this page Build a ruleset around required connections Identify the traffic your firewall must control Translate each requirement into an explicit rule Apply changes without losing administrative access Test allowed and blocked paths separately Keep private services and agent access narrowly scoped Review rules after changes and before migration Firewall configuration means defining which traffic a device or network allows or blocks. Start by securing administrative access and identifying your network zones and required connections. Create narrowly scoped rules for sources, destinations, protocols and services, deny unapproved traffic, enable useful logging, and test both allowed and blocked connections before deployment. Back up the working configuration and review it as your network changes. Check your firewall’s documentation for exact syntax, rule order and traffic scope. Build a ruleset around required connections Least privilege means permitting the connections you need rather than allowing broad access and blocking exceptions later. For a self-hosted file service, authorized personal devices need access to that service; unrelated devices do not. Scope permissions to the required addresses and service ports. Distinguish inbound traffic arriving at the protected device or network, outbound traffic leaving it, and between-zone traffic crossing internal boundaries. Deny unapproved inbound and between-zone connections. Tighten outbound access against documented application needs rather than imposing an unexplained blanket block that could break required dependencies. Identify the traffic your firewall must control Build a connection inventory before writing rules. A host firewall controls traffic at a device, while a gateway firewall controls traffic passing through its applicable network policy. Inventory devices and services. Identify the assets that need protection, their addresses, service definitions and owners. Identify the enforcement point. Trace whether each connection is local, routed between segments, internet-facing or tunneled. Define zones and addresses. Separate management, personal-device, guest and service groups where appropriate. Include IPv4 and IPv6 when enabled. Record the initiator. Note which device starts each connection and whether the application independently starts connections back. Scope varies by platform: EnGenius gateway outbound ACL rules exclude VPN traffic, so tunneled paths require separate policy assessment. Application-layer host firewalls also involve app permissions and service behavior: enabling a sharing service on macOS opens a specific port for it. Do not assume a gateway rule covers traffic outside its enforcement path. Translate each requirement into an explicit rule Make the source, destination, protocol or service, action and logging decision explicit. Network ACLs can match protocol, source address and port, and destination address and port. This table expresses policy intent, not executable configuration. All device groups, zones and service names are placeholders; logging entries are recommendations, not platform defaults. Purpose Source Destination Protocol/service Action Logging Access files Authorized personal devices Self-hosted file service Documented file-service definition Allow During validation; retain useful events Administer privately Management devices Private administration service Documented administration service Allow Access events Isolate guests Guest devices Internal service zone All traffic in this scope Deny Useful denial events Reject unapproved traffic Otherwise-unapproved sources Destinations within policy scope Otherwise-unapproved traffic Deny Useful denial events CIDR notation describes an address range using an address and a prefix length, which specifies its network portion. Source ports identify the sending endpoint; destination ports identify the receiving endpoint. Clients normally select their source ports, so do not fix them without a documented requirement. Stateful inspection tracks connections, allowing established return traffic according to the platform’s state handling; independently initiated reverse connections need their own policy assessment. Verify rule evaluation order and whether matching uses applications, ports or both on your actual firewall. Apply changes without losing administrative access Preserve a working management path before tightening access. Keep remote administration off the public internet. Confirm authorization. Change only systems and policies you are permitted to manage. Export the current configuration. Securely store a verified working backup. Verify recovery access. Confirm a local console or another documented recovery path works before changing rules. Update safely. Follow the vendor’s firmware procedure, replace default credentials with strong, unique passwords, and disable unnecessary accounts. Preserve private management. Permit only authorized management devices to reach the required administration service. Stage changes. Review the proposed rules before activation. Inspect coverage. Check rule order, interfaces, zones and both enabled address families. Apply during an appropriate change window. If access or required traffic fails, use the recovery path to restore the saved configuration. Address translation and access permission need separate checks: NAT changes addressing, while filtering controls permission. Some platforms combine filtering conditions with port-forward settings, but an EnGenius address mapping does not automatically permit inbound traffic. Test allowed and blocked paths separately Test the actual application from each relevant source zone, using devices you are authorized to test. A successful connection proves reachability for that tested path, not correctness of the entire policy. Test the allowed path. Connect an authorized personal device to the self-hosted file service. Test the denied path. Attempt the same service from a guest device that should be blocked. Correlate attempts with enforcement. Inspect the matching rule and available logs; rule-specific logging supports monitoring and troubleshooting. Investigate mismatches before widening access. For a failed expected allow, check whether the service is listening, then name resolution, route, interface, address family and matching rule. For a successful expected deny, inspect precedence, alternate paths, and both host and gateway policies. A failed connection alone does not prove firewall enforcement. Ping is not an application test: macOS can answer authorized apps while leaving unauthorized ping requests unanswered. On a stateful firewall, established replies usually do not require an unrestricted reverse-direction allow. Keep private services and agent access narrowly scoped Before adding public port forwarding, ask whether the service needs public users at all. If only your devices or authorized agents need it, prefer a private path restricted to required destinations and services, while retaining host controls and application authentication. Keep firewall administration interfaces inaccessible from the public internet. doxx.net is a private network with documented firewall controls and authorized API/MCP tools for managing network resources. If that fits your private-access task, use the website’s Get Started and Download paths to create an account, download the app and connect a device or agent. For agent-generated changes, specify explicit policy intent, bound the agent’s authorization, review the proposal and keep validation separate from the language model’s proposal. Generated rules need additional validation beyond ordinary human-reviewed changes; this is general guidance, not a claim about automatic doxx.net safeguards. Network restrictions do not prevent prompt injection, malware or all data leakage. Review rules after changes and before migration Keep policy aligned with service, address and topology changes. A rule that appears unused may still support an infrequent but required connection. Record ownership and purpose. Keep a change record for every configuration change. Review logs. Investigate unexpected allows, denials and changes in traffic patterns. Inspect stale objects. Check unused or overlapping rules and addresses before removing them. Patch and preserve recovery. Update supported systems and retain verified working backups. Retest changed paths. Repeat allowed and denied tests after service, address or topology changes. During migration, preserve policy intent but do not assume direct export/import between different configuration models. Check target defaults, NAT behavior, object definitions and rule semantics: application-aware rules may become port-based rules on another platform. Test the replacement separately and plan a reversible cutover before retiring the working firewall. On this page Build a ruleset around required connections Identify the traffic your firewall must control Translate each requirement into an explicit rule Apply changes without losing administrative access Test allowed and blocked paths separately Keep private services and agent access narrowly scoped Review rules after changes and before migration Author doxx.net Editorial Category security Published 6 Oct 2026 Reading time 06 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 security Blocking Encrypted DNS Traffic: What It Means and What to Check Learn what an encrypted DNS warning means, how blocking affects privacy, and how to check device settings, network controls and DNS fallback. doxx.net Editorial 6 min read 6 Oct 2026 security AI Browser Agent Security: Current Risks and Practical Controls AI browser agents remain vulnerable to prompt injection. Learn how scoped access, execution controls, approvals and recovery tests limit exposure. doxx.net Editorial 9 min read 6 Oct 2026 security EAP methods for Wi-Fi: what they mean and which to choose Understand EAP-TLS, PEAP and EAP-TTLS, match your enterprise Wi-Fi profile, validate server certificates and troubleshoot authentication failures. doxx.net Editorial 10 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## How to Change Your Wi-Fi Channel URL: https://www.doxx.net/insight/how-to-change-wifi-channel/ Product Resources Pricing Get Started Insights How to Change Your Wi-Fi Channel Change your router’s Wi-Fi channel, choose settings for each band, test performance, and learn what to do if channel controls are locked. On this page Change the channel in your router settings Choose a channel for the band you use Check local Wi-Fi performance before blaming the internet If the channel setting is missing or locked When a different channel does not fix the problem To change your Wi-Fi channel, connect to your home network and sign in to your router’s official app or local admin page. Open Wi-Fi or Wireless settings, select the band you want to change, switch Channel from Auto to a supported channel, and select Save or Apply. For 2.4 GHz, start with channel 1, 6, or 11 at 20 MHz width. Your Wi-Fi may disconnect briefly, so reconnect and test before keeping the new setting; some provider-managed routers do not offer manual channel selection. Change the channel in your router settings You change the channel on the router, not separately on each connected device. Your devices normally follow the router’s channel automatically. Menu names and management addresses vary by model. If available, connect your computer to a router LAN port with an Ethernet cable so changing the wireless settings does not interrupt your management connection. Confirm authorization. Work only on a router you own or are authorized to manage. Open the official management interface. Use the router’s official app, or find its local management address in the router documentation or your connected device’s network gateway details. Sign in as the administrator. The router administrator password may differ from the password you use to join Wi-Fi. Follow the documented access method rather than bypassing certificate warnings. Find the wireless controls. Look for Wireless, Wi-Fi, or Radio settings, then select the band you want to adjust. Record the current settings. Note the channel, whether selection is automatic, and the channel width before changing anything. Choose the channel. Switch from Auto to an available channel. Use the band-specific starting choices below. Save and reconnect. Select Save or Apply, allow Wi-Fi to resume, then reconnect your device and test. If you lose access, reconnect by Ethernet or another supported Wi-Fi band. Restore the recorded settings or return channel selection to Auto. Choose a channel for the band you use A band is a frequency range, a channel is a portion of that range, and channel width determines how much spectrum the connection occupies. Choose the band first, then consider its channel and width together. Band Starting choice When to adjust 2.4 GHz Channel 1, 6, or 11 at 20 MHz width Compare these choices when interference or inconsistent performance persists. 5 GHz Auto For persistent drops, consider an available non-DFS channel permitted by your router’s regional configuration. 6 GHz Auto, where supported Consider a manual trial only when your router supports it and testing shows a repeatable benefit. Automatic selection is often the better starting point on 5 GHz and 6 GHz. On 2.4 GHz, compare the recommended channels rather than choosing an apparently empty channel that overlaps neighboring traffic. If you use a compatible Wi-Fi scanning tool, consider competing signal strength as well as network count. A scan at the affected device’s location can guide a manual trial because nearby interference may differ from what the router observes. Wider channels can increase potential throughput when spectrum is clear, but they also increase exposure to interference. Narrower channels can be worth testing in a congested environment. Use only channels your router permits for its actual region; do not change the country setting to unlock other channels. Check local Wi-Fi performance before blaming the internet A useful channel change produces a repeatable improvement where you actually use Wi-Fi. Compare the same activity under similar conditions rather than treating a single good result as proof. Establish a baseline before changing settings. Use the same device in the problem location. Record dropouts and the result of a repeatable activity, such as a file transfer or internet speed test. Use a local test where practical. Copy a non-sensitive test file between devices you own using an existing, authorized local sharing method. Change one setting at a time. Keep width unchanged while comparing channels, then test width separately if needed. Reconnect and repeat. Use the same device, location, file, and activity. Keep only a repeatable improvement. If results worsen or remain inconsistent, restore the previous setting or Auto. A local transfer helps separate home-network performance from internet-service performance, although either device can still limit the result. An internet speed test measures more than the radio link, and changing channels does not increase your internet connection’s purchased capacity. Radio tuning and private communication are separate tasks. Changing a Wi-Fi channel does not add encryption, prevent tracking, or make your network private; you do not need to weaken security settings to test it. If the channel setting is missing or locked A missing or greyed-out channel control can reflect provider-managed automatic selection, not a mistake you made. Some provider-supplied routers do not expose manual channel controls. Check the exact model’s current documentation. Confirm whether it supports manual selection and where that control belongs. Check the official app. Advanced Wi-Fi settings may be managed differently from the browser interface. Ask the provider or manufacturer. Confirm which settings your equipment and service configuration support. Leave Auto enabled if manual selection is unavailable. Continue troubleshooting with the performance comparisons below. Do not factory-reset the router merely to search for a missing control. Unsupported firmware or casual bridge-mode changes are not appropriate shortcuts for this task. When a different channel does not fix the problem A channel change can reduce interference and competition for airtime, but it cannot repair every coverage, device, or internet-service problem. Compare performance near the router with performance in the affected room, using the same device and activity. If performance is good nearby but poor in the distant room, investigate router placement and coverage. If available, compare Wi-Fi with an Ethernet connection; poor performance over Ethernet makes channel selection unlikely to be the main cause. These results are diagnostic clues, not proof of a single fault. If drops occur only on a DFS channel, consult the router documentation about radar-related interruptions and channel changes. Test an allowed non-DFS option rather than assuming every channel is available in every country or router model. For persistent faults, give the provider or manufacturer your router model, firmware version, affected devices, and recorded before-and-after results. Include whether the problem occurs near the router, in another room, or over Ethernet so troubleshooting can move beyond repeatedly guessing channels. On this page Change the channel in your router settings Choose a channel for the band you use Check local Wi-Fi performance before blaming the internet If the channel setting is missing or locked When a different channel does not fix the problem Author doxx.net Editorial Category Networking Published 6 Oct 2026 Reading time 06 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 Networking Can You Access Your NAS From Anywhere? Yes, you can access your NAS from outside your home network once you configure remote access. doxx.net Editorial 11 min read 6 Oct 2026 Networking How to Find the IP Address of a Printer Find your printer's IP address using its display, a network report, Windows or Mac settings, or your router. Confirm the address before printing. doxx.net Editorial 10 min read 6 Oct 2026 Networking How to Fix Slow DNS Lookup Measure DNS lookup delays on Windows, macOS and Linux, identify the slow layer, apply a targeted fix, and retest without breaking private access. doxx.net Editorial 11 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## How to Encrypt Telnet Traffic with IPsec or TLS URL: https://www.doxx.net/insight/how-to-encrypt-telnet-traffic/ Product Resources Pricing Get Started Insights How to encrypt Telnet traffic Protect Telnet with compatible IPsec or TLS endpoints, require encryption, check path coverage, and test that plaintext access is blocked. On this page Choose an encryption method your endpoints support Map the protected path before configuring anything Configure IPsec to require encryption for Telnet Use TLS only with a compatible terminal implementation Verify encryption and test that plaintext is blocked Replace legacy Telnet when the device supports SSH Ordinary Telnet does not encrypt credentials or commands. To keep using Telnet, configure authenticated IPsec encryption between compatible endpoints, or use a Telnet-over-TLS implementation supported by both ends. Require encryption rather than allowing plaintext fallback. Encryption protects only the path between its endpoints: if a tunnel terminates at a gateway, the remaining connection to the Telnet device is still plaintext unless separately protected. Choose an encryption method your endpoints support For ordinary remote administration, replacing Telnet with SSH is usually preferable when the device supports it. Retain Telnet inside a protected transport when a legacy device or required terminal workflow cannot use SSH. Method Prerequisites Protected path Telnet remains in use? IPsec between compatible hosts IPsec support, trusted peer authentication, and matching policies on both hosts Host-to-host transport mode protects traffic between your computer and the Telnet server Yes Encrypted tunnel ending at a gateway Compatible encryption endpoints and a gateway that can reach the device Computer to gateway; onward Telnet traffic remains plaintext unless separately protected Yes Supported Telnet-over-TLS Compatible terminal implementations and trusted certificate configuration Between the TLS endpoints Yes, within the supported implementation SSH replacement SSH support on the device and a compatible client Between the SSH client and server No An ordinary Telnet client connecting to an arbitrary port does not automatically negotiate TLS. Both ends need supported TLS functionality, not merely a different port setting. Map the protected path before configuring anything Draw the complete route: your computer, any encryption gateway, and the legacy Telnet device. With host-to-host IPsec, your computer and the Telnet server are the encryption peers, so protection reaches the server. With a gateway-terminated tunnel, protection stops at the gateway. For an unavoidable plaintext segment, place the device on a dedicated management or out-of-band network and limit access to the authorized gateway. This reduces exposure but does not encrypt packets. Private addressing, segmentation, and access controls are useful restrictions, not substitutes for transport encryption. Configure IPsec to require encryption for Telnet IPsec policies can protect all traffic between the peers or select a service port. Choose service-specific protection when only Telnet needs encryption, or broader coverage when other traffic between those hosts also needs protection. Get authorization and preserve recovery access. Record the existing configuration on both endpoints. Keep console access or another verified recovery path available before changing policies. Confirm compatibility. Check that both encryption endpoints support compatible IPsec modes, authentication methods, and encryption settings. Choose the endpoint arrangement. Use host-to-host transport mode when your workstation and the Telnet server are the peers. A gateway arrangement protects only the path ending at that gateway. Configure trusted peer authentication. Establish mutually trusted authentication using a method both implementations support. Confirm each endpoint is configured to authenticate the intended peer. Match the traffic selectors. Define matching policies for the peer addresses, TCP, and the actual Telnet service port. For default TCP port 23, the client policy matches the remote port, while the server policy matches the local port; include return traffic. Require encryption and integrity. Apply protection in both directions and reject communication with peers that do not support IPsec. Do not enable unsecured fallback. Activate both policies and check negotiation. Confirm an encrypted IPsec security association is active between the intended peers before entering Telnet credentials. Configuration interfaces vary by implementation; historical policy screens are not a universal procedure for current systems. If negotiation fails, stop and restore the recorded policy through your recovery path rather than allowing plaintext. Use TLS only with a compatible terminal implementation TLS terminal access requires compatible behavior at both ends and trusted certificate configuration. Enable the implementation’s documented secure mode, then configure the certificates and trust settings it requires. Changing the destination port alone does not add encryption to ordinary Telnet. A specific example is IGEL Secure Terminal: its UMS-to-device connection uses TLS/SSL, and only a UMS whose certificate is stored on the device can initiate it. That workflow applies to this implementation, not unrelated Telnet clients or appliances. If certificate validation fails, correct the trust or identity configuration using the implementation’s documentation; do not bypass validation. Verify encryption and test that plaintext is blocked A successful login proves that access works, not that the path is protected. Combine connection-state checks, correctly placed packet captures, and a controlled test of what happens without encryption. Inspect the negotiated protection. Check IPsec security associations or TLS connection status. Confirm the intended peers, active encryption, authentication status, and, for IPsec, the expected traffic selectors. Capture on the network carrying encrypted traffic. With authorization, observe the segment between the encryption endpoints during a session using a disposable test account. Check the transport. Look for the expected protected traffic, not readable Telnet credentials or commands. Confirm the session follows the route you mapped. Inspect the onward segment separately. If encryption ends at a gateway, check the gateway-to-device connection. Do not treat an encrypted outer tunnel as proof that this segment is encrypted. Test rejection of plaintext. During controlled maintenance, with recovery access available, confirm that a client without the required protection cannot access the Telnet service. Restore temporary test changes. Return test policies and access settings to their intended state, then confirm protected access still works. An endpoint or loopback capture can legitimately show application data after decryption. Conversely, unreadable traffic alone does not prove correct peer authentication or complete path coverage. If a capture on a supposedly protected network segment shows readable session content, or the plaintext-access test succeeds, stop using production credentials. Correct routing and policy coverage, then repeat the checks. Replace legacy Telnet when the device supports SSH Transport encryption does not modernize vulnerable Telnet software, secure compromised endpoints, or protect plaintext beyond a tunnel endpoint. When SSH is available, establish and verify authorized SSH access with console recovery available, then disable Telnet after SSH is functioning and tested. For a device that cannot support SSH, document a time-limited exception, restrict management access, and maintain a retirement path. Protected transport is a containment measure, not a permanent fix for an unsupported device. Suitable legacy hardware may also work with an SSH-accessible console manager. You connect securely to the manager and use the device’s console from there. That replaces the network Telnet session with console access; it does not encrypt Telnet itself. On this page Choose an encryption method your endpoints support Map the protected path before configuring anything Configure IPsec to require encryption for Telnet Use TLS only with a compatible terminal implementation Verify encryption and test that plaintext is blocked Replace legacy Telnet when the device supports SSH Author doxx.net Editorial Category security Published 6 Oct 2026 Reading time 06 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 security Blocking Encrypted DNS Traffic: What It Means and What to Check Learn what an encrypted DNS warning means, how blocking affects privacy, and how to check device settings, network controls and DNS fallback. doxx.net Editorial 6 min read 6 Oct 2026 security AI Browser Agent Security: Current Risks and Practical Controls AI browser agents remain vulnerable to prompt injection. Learn how scoped access, execution controls, approvals and recovery tests limit exposure. doxx.net Editorial 9 min read 6 Oct 2026 security EAP methods for Wi-Fi: what they mean and which to choose Understand EAP-TLS, PEAP and EAP-TTLS, match your enterprise Wi-Fi profile, validate server certificates and troubleshoot authentication failures. doxx.net Editorial 10 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## How to Find Your Printer's IP Address URL: https://www.doxx.net/insight/how-to-find-ip-address-of-printer/ Product Resources Pricing Get Started Insights How to Find the IP Address of a Printer Find your printer's IP address using its display, a network report, Windows or Mac settings, or your router. Confirm the address before printing. On this page Find the address on the printer’s display or network report Check an installed printer on Windows Check an installed printer on Mac Look in your router’s connected-device list Resolve a missing or unusable address Confirm the printer before using its address The quickest starting point is your printer’s display: open its network or wireless settings and look for IP Address or Network Status. If you cannot find it there, print a network configuration report. You can also check an already-installed printer’s details on Windows or Mac, or your router’s connected-device list. A USB-only printer may not have a network IP address. Find the address on the printer’s display or network report The printer’s display or a fresh network report provides its reported address directly in most cases. Check the active Wi-Fi or Ethernet connection, rather than an interface that is disconnected. Turn on the printer. Wait until it is ready, then open its settings using the display or control-panel buttons. Open the network settings. Look for Network, Wireless, or a similar menu. Labels can include Network Configuration, Wi-Fi Status, TCP/IP Settings, or Network Info, but the exact path varies by model. Find the address field. Look for IP Address or Network Status. An illustrative address is 192.168.1.45; use the address your printer actually displays. Print a report if the display does not show it. Follow your model’s manual to print a Network Configuration, Network Status, or equivalent report. On applicable printers, the Connectivity section lists the IPv4 or IPv6 address. Record the active connection’s address. Do not copy the gateway address or MAC address instead. If the report lists separate wired and wireless information, use the interface through which the printer is connected. The field label matters more than the appearance of the value. A gateway address belongs to the network’s routing connection, while a MAC address identifies a network interface; neither is a substitute for the printer’s IP address. Keep the report nearby so you can compare it with the computer’s saved settings or the router’s entry. A fresh reading shows what the printer reports now, not whether your computer can reach it or print successfully. If the menu labels or button sequence differ, use the model’s manual rather than trying a path intended for another printer. If the active connection shows no usable address, follow the troubleshooting section below. Check an installed printer on Windows Windows port inspection usually exposes a configured address when the printer uses a Standard TCP/IP Port. That address is a saved connection setting, so compare it with a current printer report before treating it as the printer’s present address. Open the printer’s settings. In Windows 11, go to Settings > Bluetooth & devices > Printers & scanners. Select your printer. Open Printer properties, then select the Ports tab. Find the checked port. This is the port selected for that printer queue. If it is a Standard TCP/IP port, select it and open Configure Port. Read the configured destination. Look for Printer Name or IP Address. Copy the explicit address if one is shown; if the field contains a hostname, use the printer’s report or router list to find its current numeric address. Cancel without changing anything. Close the configuration dialog with Cancel. This is a read-only lookup, so you do not need to add a port or alter its settings. Use the destination field inside Configure Port, not just the port’s name. A port name can contain an address left over from an earlier setup, even when it no longer reflects the printer’s current connection. If the stored destination differs from a fresh printer report, confirm the printer’s identity before changing the computer’s configuration. A separate device Properties dialog may show Connected Device information, and some entries may have Web Services details. This is different from Printer properties, which contains the print queue’s port settings. Do not choose between dialogs by counting tabs, and do not assume a Location field contains an IP address. A WSD discovery-based port or a shared print queue may not expose the physical printer’s address through this route. Use the printer’s display, a fresh network report, or an authorized router lookup instead. If Configure Port is unavailable or access is restricted, stop the lookup there rather than changing permissions or guessing at another queue’s settings. Check an installed printer on Mac An explicitly IP-configured printer can expose a useful address in its Mac settings. Discovery-based entries and descriptive fields may not show a numeric address, so treat anything you find as a candidate to confirm. Open the printer settings. Choose Apple menu > System Settings > Printers & Scanners. Older interfaces use the name System Preferences instead of System Settings. Select the correct printer. Choose the entry you actually use for printing, especially if several entries have similar names. Inspect its details. Open Options & Supplies if that option is available. For supported printer entries, this screen can display the printer’s IP address. Check what the field contains. An explicit IP address is useful for comparison. An empty field, a room description, or a hostname is not a confirmed numeric address. Verify against current network information. Compare the candidate with the printer’s display or a fresh network report. If no explicit address appears, use the router’s connected-device list. A Location field can describe where a printer sits rather than how to reach it. Text identifying a room or department is not an IP address, and a hostname is a name rather than the numeric address you are trying to find. Even when Location contains an address, confirm it independently before using it. Do not edit Location to change the printer’s network address. Changing a descriptive field on the Mac does not configure the printer’s own network connection. For a basic lookup, leave the installed printer unchanged until you have confirmed its current address and know whether the saved connection needs updating. Look in your router’s connected-device list Your router’s connected-device list can identify the printer even when it is not installed on your computer. Match the entry by name and preferably by the active interface’s MAC address, since a generic manufacturer name can belong to more than one device. Use an authorized router account. Open the router’s documented local administration address or official app, and sign in only if you have access rights to administer it. Open the device list. Look for Connected Devices, Clients, DHCP Clients, or a similar section. Find the printer’s entry. Look for its name or MAC address and the IP address alongside it. Compare the MAC address with the printer’s network report when the name is unclear. Check the active interface. Match the information for the connection the printer is using, whether Wi-Fi or Ethernet. Do not identify it solely from an entry for a disconnected interface. Record the printer’s address and sign out. Leave the router’s settings unchanged after this read-only lookup. The address you use to open the router’s administration page is the router’s address, not the printer’s. Copy the address from the matched device entry instead. If several devices have similar names, the printer’s report gives you a better basis for identification than guessing from the list. If the printer is missing, check that it is powered on and connected to the intended network. In a router app, also confirm that you have selected the network where the printer is connected. A missing entry is a reason to check the connection, not to reset the router or change unrelated settings. On a managed office network, ask the administrator to identify the printer or confirm its address. Do not guess administrative credentials or reset shared infrastructure to obtain access. You can still use the printer’s own display or report if you are authorized to access the device. Resolve a missing or unusable address A connected Wi-Fi or Ethernet printer normally has a network address; USB-only operation may provide no network address to find. Other results can point to an inactive interface, unsuccessful address assignment, or an outdated computer setting. Result Meaning Next action The printer only supports USB connections It may have no network IP address. Use its USB printing setup. Connecting by USB does not automatically reveal a network address. An inactive interface shows 0.0.0.0 That interface is not showing a usable assigned address. Check the active Wi-Fi or Ethernet section. If the active interface also lacks an address, reconnect using the model’s documented procedure. The active connection shows a self-assigned address Normal network address assignment may have failed. Check the connection and network settings, then follow the printer’s documented reconnection procedure. The computer’s stored address differs from a fresh printer report The saved destination may be stale. Confirm the printer’s identity, then update or re-add the computer’s printer connection using the current address. The router entry has an unclear name or is missing The entry does not yet identify the printer reliably. Compare the active-interface MAC address, check power and connection, and confirm the selected network. The connectivity warning for the Xerox models covered by this procedure treats 0.0.0.0 or an address beginning with 169 as a network connectivity issue. That is a model-specific diagnostic instruction, not a rule that every address beginning with 169 is invalid. Use the address’s context and the model’s guidance rather than its opening digits alone. Start with the active connection and the printer’s documented network setup. Factory resets, disabling IPv6, and rebooting shared infrastructure are not default steps for finding an address. After reconnecting, read the display again or print a fresh report before retrying the computer’s setup. For recurring address changes, an authorized administrator can use a router DHCP reservation tied to the printer’s MAC address. A reservation controls the address the router assigns on that network; a manually configured static address is set on the printer itself. Neither changing a computer’s print port nor editing a Mac Location field changes the printer’s own address, and any fixed setup must still fit the network where the printer is connected. Confirm the printer before using its address Confirm the device’s identity before adding it by IP address. Keep the lookup and subsequent printing on the intended local or otherwise authorized network, without exposing printer services to the public internet. Compare current records. Match the address on a fresh printer report with the router’s entry, if you can access it. Check the printer’s model or name and the active-interface MAC address rather than relying on the IP address alone. Use the confirmed address in the add-printer workflow. Enter it through your operating system’s normal printer setup, or correct an outdated installed connection after confirming the destination. Choose the driver appropriate for your printer. Print a test page. Use the setup workflow’s test-page option when offered, and check that the page comes from the intended printer. If the test fails, recheck the path. Confirm the current address again, check that the computer can reach the printer on the intended network, and review the selected driver. On a managed network, ask the administrator about access restrictions instead of altering shared network controls. A successful test page checks the print path from that computer through its configured queue to the printer. A ping reply alone does not identify a device as your printer or prove that printing works. Likewise, finding an IP address does not establish an encrypted or private printing connection. You do not need public port forwarding to complete this lookup. Keep printer services and remote administration off the public internet rather than using exposure as a workaround for a failed test. If printing must cross network boundaries, use an arrangement authorized for that network instead of assuming that knowing the address makes the printer safely reachable. On this page Find the address on the printer’s display or network report Check an installed printer on Windows Check an installed printer on Mac Look in your router’s connected-device list Resolve a missing or unusable address Confirm the printer before using its address Author doxx.net Editorial Category Networking Published 6 Oct 2026 Reading time 10 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 Networking Can You Access Your NAS From Anywhere? Yes, you can access your NAS from outside your home network once you configure remote access. doxx.net Editorial 11 min read 6 Oct 2026 Networking How to Change Your Wi-Fi Channel Change your router’s Wi-Fi channel, choose settings for each band, test performance, and learn what to do if channel controls are locked. doxx.net Editorial 6 min read 6 Oct 2026 Networking How to Fix Slow DNS Lookup Measure DNS lookup delays on Windows, macOS and Linux, identify the slow layer, apply a targeted fix, and retest without breaking private access. doxx.net Editorial 11 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## How to Fix Slow DNS Lookup URL: https://www.doxx.net/insight/how-to-fix-slow-dns-lookup/ Product Resources Pricing Get Started Insights How to Fix Slow DNS Lookup Measure DNS lookup delays on Windows, macOS and Linux, identify the slow layer, apply a targeted fix, and retest without breaking private access. On this page Start with a measured, reversible fix Separate DNS delay from connection and server delay Use the pattern of failures to choose your next step Correct stale local answers and browser-only problems Repair unreachable resolvers and router forwarding Keep private names and DNS protections working Investigate authoritative DNS when one domain stays slow Verify the improvement and keep a recovery path To fix slow DNS lookup, first confirm that name resolution is causing the delay. Repeat the same hostname query through your current resolver and an approved alternative, then fix the layer the comparison identifies: stale local answers, browser DNS overrides, unreachable configured servers, router forwarding, or the domain’s authoritative DNS. Change one setting at a time and repeat the original tests. Restore your previous configuration if the change does not help or breaks internal names. Start with a measured, reversible fix DNS translates a hostname into the address an application needs to connect. A pause before a page loads can happen during that lookup, but it can also happen while establishing the connection or waiting for the server. Use this sequence rather than starting with a cache flush or a provider switch: Confirm DNS timing. Inspect the affected request, then run a separate hostname lookup. Compare repeated queries. Keep the hostname, record type and connection unchanged while testing your current resolver and an approved alternative. Locate the affected layer. Compare browsers, devices and, where authorized, another network. Make one matching change. Correct the browser setting, stale local answer, resolver configuration or router issue indicated by the comparison. Retest and recover. Check both public websites and legitimate private services. Restore the previous configuration if performance worsens or internal names stop resolving. Save the original settings before changing them. If several devices are affected, focus on their shared router or resolver rather than clearing every device’s cache. Separate DNS delay from connection and server delay The browser’s request timing tells you which phase needs attention. A large DNS lookup phase alongside normal connection and response phases identifies DNS as part of the delay. Inspect the affected request. Open your browser’s developer tools and its Network tab, reload the page, and select the first document request. Separate DNS lookup, initial connection, TLS negotiation and server response time. If DNS timing is normal, investigate the slow connection, TLS or response phase instead. Run a DNS-only comparison. Use the commands below for your operating system. These read-only tests normally need no administrator rights and make no settings changes to undo; query only permitted destinations and resolvers. Keep the answers and errors. Record the hostname, resolver, returned addresses, elapsed time and any timeout. Repeat during the slowdown rather than treating one result as a diagnosis. Windows PowerShell This measures a DNS-only query through the configured resolver, then an approved alternative. Enter the same hostname for both tests. $hostname = Read-Host "Permitted public hostname" $baseline = Measure-Command { Resolve-DnsName -Name $hostname -Type A -DnsOnly | Out-Host } $baseline.TotalMilliseconds $resolver = Read-Host "Approved resolver address" $comparison = Measure-Command { Resolve-DnsName -Name $hostname -Type A -DnsOnly -Server $resolver | Out-Host } $comparison.TotalMilliseconds The displayed elapsed time includes command execution overhead, so use it for consistent comparisons rather than as a packet-level measurement. Preserve the displayed answers or errors as well as the time. macOS and Linux Use dig if it is installed. Replace HOSTNAME and RESOLVER_ADDRESS with the permitted hostname and approved resolver address: dig HOSTNAME A dig @RESOLVER_ADDRESS HOSTNAME A Compare the answer, status and query time. dig does not necessarily follow browser Secure DNS settings or the operating system’s complete name-service path, so a fast result does not rule out an application-specific problem. Keep IPv4 address queries, A, separate from IPv6 address queries, AAAA. The first query is not necessarily uncached, especially at a public resolver, and clearing your device’s cache does not clear upstream caches. Ping’s elapsed time is not DNS timing, and visiting an HTTPS site by IP address is not a substitute for this comparison. Use the pattern of failures to choose your next step The scope of the slowdown narrows the likely cause. Compare another browser, another device and another authorized connection before changing settings; each comparison narrows the investigation rather than proving a cause conclusively. Symptom Comparison test Next action Only one browser stalls Open the same site in another browser on the same device Inspect Secure DNS, extensions and proxy settings Only one device struggles Test another device on the same network Inspect device DNS settings, tunnel configuration and active interfaces All devices on the network struggle Compare wired and wireless connections, then another authorized network Investigate the router, upstream resolver and shared network path One domain stays slow across networks Query the same record through multiple permitted resolvers Investigate authoritative nameservers and alias chains A pause ends in eventual success Inspect configured DNS servers and test each permitted server Look for unreachable resolvers, timeouts or packet loss Repeat queries become faster Repeat the same hostname and record type Account for caching before attributing the improvement to a setting The browser, device and network comparison determines where to look next. For example, a working browser on the same device points toward browser-specific settings, while several affected devices point toward something shared. A faster repeat commonly reflects a cache hit somewhere along the resolution path, not necessarily on your device. When several resolvers slow down together, investigate the shared network path; when an alternative repeatedly performs better under comparable conditions, investigate the configured resolver or its forwarding path. Correct stale local answers and browser-only problems Browser-only stalls call for browser checks before system-wide changes. Local cache clearing is useful after a stale answer or corrected configuration, but it should be a targeted, one-time action, not routine optimization. Compare browser settings. Check Secure DNS, extensions and proxy settings against a working browser. A browser DNS override may use a different resolver from your operating system. Record each original setting before testing a change, and restore it if the change does not help. Clear a justified local cache. Use the applicable command below only on a device you administer, with authorization for administrator or sudo access. Restart the browser and retest. Query the original hostname and retry the affected page. If only the browser still stalls, return to its configuration rather than repeatedly flushing the system cache. Windows Run Command Prompt or PowerShell as administrator: ipconfig /flushdns macOS Run these commands in Terminal with authorized sudo access: sudo dscacheutil -flushcache sudo killall -HUP mDNSResponder macOS may give no success message. Retest the lookup rather than treating silence as failure. Linux using systemd-resolved If your system uses systemd-resolved, run: sudo resolvectl flush-caches These commands remove cached answers; they do not repair a persistently slow upstream resolver. Caches repopulate automatically and have no undo command, while repeated flushing sacrifices their benefit. For advanced Linux troubleshooting, fast direct DNS replies with slow application resolution justify inspecting the Name Service Switch, or NSS, and multicast DNS configuration. Review your distribution’s intended name-service path rather than applying a historical configuration edit universally. Repair unreachable resolvers and router forwarding An unexpected or unreachable DNS server can cause a pause before another lookup succeeds. Inspect every configured server on every active interface, including virtual interfaces, rather than assuming the visible primary setting tells the whole story. Inspect the current configuration. These read-only commands normally need no administrator rights: Windows PowerShell: Get-DnsClientServerAddress. Alternatively, use ipconfig /all. macOS Terminal: scutil --dns. Linux with systemd-resolved: resolvectl status. A local stub address points to a resolver service on your device, not necessarily the upstream server. DNS settings may come from DHCP, a network manager or a tunnel, so correct them through the system that manages them. Test permitted servers individually. Use the same hostname and record type from the earlier tests. Do not assume every listed server is reachable or that applications use them strictly in the displayed order. Trial an approved alternative on one device. Save the original addresses or note automatic assignment before changing settings. Keep a provider’s primary and secondary addresses together so their filtering policies remain consistent. Restore the recorded values or automatic assignment if the trial fails. Check router forwarding when the problem is shared. Where policy permits, compare queries through the router with direct queries to the same upstream resolver. A difference narrows the issue to the forwarding path rather than comparing unrelated providers. Restart only a router you administer, and warn other users that connections will be interrupted. If the problem returns, review firmware and DHCP DNS configuration rather than starting with a factory reset or blanket network reset. After changing DHCP DNS, renew leases or reconnect clients so they receive the new settings. Keep private names and DNS protections working Public-resolver comparisons suit permitted public names; private names need their intended DNS route. A public resolver may not know an internal zone, so replacing DNS globally can make a private service unreachable even when public sites become faster. Choose a non-sensitive public hostname. Do not send internal service names to an external resolver just to measure speed. Test legitimate private-service access separately through its intended route. Inspect overlapping DNS controls. Check browser encrypted-DNS overrides, tunnel-supplied DNS, split DNS, filtering and stale virtual-interface settings. Split DNS sends different names to different resolvers, so a global replacement can remove routing that private access needs. Separate tunnel effects only when authorized. For a public site that does not require the tunnel, compare with the tunnel disconnected where policy allows. Do this only when it will not expose sensitive activity, and do not disable interfaces needed for managed access. Keep protections active. Leave firewall and DNS-rebinding protections enabled. Use logs or an administrator-approved, narrowly scoped change when a legitimate internal domain needs an exception. Encrypted DNS describes how DNS traffic is transported, not whether a resolver is faster. Judge latency from comparable measurements, and restore the intended browser, tunnel and DNS routing configuration after testing. A faster public lookup is not a successful fix if it breaks private access or bypasses required filtering. Investigate authoritative DNS when one domain stays slow A domain that remains slow through multiple resolvers and networks points toward its own DNS configuration. Recursive resolvers fetch and cache answers for clients; authoritative nameservers publish the domain’s records, so these are different parts of the lookup path. Confirm the domain-specific pattern. Compare the same record type through multiple permitted recursive resolvers. If other domains resolve normally, check the affected domain’s authoritative nameservers. Inspect delegation and authoritative replies. On macOS or Linux with dig installed, the read-only commands below normally need no administrator rights. Replace the placeholders and use them only where direct DNS traffic is permitted. Act according to ownership. If you administer the domain, inspect nameserver availability, delegation and unnecessary alias chains. Otherwise, send reproducible results to the domain operator. dig ZONE NS dig @AUTHORITATIVE_SERVER HOSTNAME A +norecurse dig HOSTNAME A +trace ZONE is the relevant DNS zone, and AUTHORITATIVE_SERVER is one of its nameservers. The direct query asks that server for an answer without requesting recursion; an authoritative server does not provide the same general recursive service as your usual resolver. A delegation trace follows the lookup path, but restricted direct DNS traffic can prevent it from completing. For a slow domain, a delegation trace can help investigate authoritative servers or a CNAME alias chain. Review TTL choices against how often records change: TTL controls DNS record caching, not cached page-content freshness, and is not a universal speed setting. If DNS replies are prompt but the browser shows slow TLS or initial connection timing, move the investigation to that phase. Changing DNS records is not a remedy for a delay elsewhere. Verify the improvement and keep a recovery path A successful fix improves the original symptom while preserving correct answers and required access. Faster timing alone is insufficient if lookups fail, return unsuitable answers or stop resolving private services. Repeat the original comparison. Use the same domains, record types, connection and timing method after the single change. Keep several timings and failures, not just the fastest result. Check actual behavior. Retry the affected browser or application and legitimate private services. Confirm that answers are expected, errors have not increased and the original pause has improved. Keep a compact before-and-after record. Item Before After Resolver and connection Original addresses or automatic assignment, active connection The single setting changed Same hostnames and record types Typical timings, answers and failures Repeated timings, answers and failures Original symptom Where the application pauses Whether that pause improves Private access Required services resolve and connect Access still works as intended Restore or escalate. Restore recorded DNS settings and any changed browser or tunnel configuration if results worsen. Direct the problem to the device administrator, router administrator, internet provider, resolver operator or domain operator according to the isolated layer. For escalation, include timestamps, resolver identity, the relevant public hostname, returned results or errors, and the scope of affected devices. State whether the slowdown occurs in DNS timing or a later connection phase, and which comparisons reproduce it. Redact private names and sensitive logs before sharing. On this page Start with a measured, reversible fix Separate DNS delay from connection and server delay Use the pattern of failures to choose your next step Correct stale local answers and browser-only problems Repair unreachable resolvers and router forwarding Keep private names and DNS protections working Investigate authoritative DNS when one domain stays slow Verify the improvement and keep a recovery path Author doxx.net Editorial Category Networking Published 6 Oct 2026 Reading time 11 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 Networking Can You Access Your NAS From Anywhere? Yes, you can access your NAS from outside your home network once you configure remote access. doxx.net Editorial 11 min read 6 Oct 2026 Networking How to Change Your Wi-Fi Channel Change your router’s Wi-Fi channel, choose settings for each band, test performance, and learn what to do if channel controls are locked. doxx.net Editorial 6 min read 6 Oct 2026 Networking How to Find the IP Address of a Printer Find your printer's IP address using its display, a network report, Windows or Mac settings, or your router. Confirm the address before printing. doxx.net Editorial 10 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## How to Lower Ping in Games: Practical Fixes URL: https://www.doxx.net/insight/how-to-lower-ping/ Product Resources Pricing Get Started Insights How to Lower Ping in Online Games Lower gaming ping by testing Ethernet, pausing heavy transfers and comparing game regions. Diagnose lag spikes and know when to contact your ISP. On this page Start with the quickest fixes Check whether the problem is actually ping Test Ethernet, then improve Wi-Fi if needed Reduce lag spikes when your connection is busy Choose a game region by measured latency Test alternate routes without weakening security Know when the fix is outside your home To lower ping, pause background downloads and uploads, try Ethernet instead of Wi-Fi, and choose the game region with the lowest measured latency. Check your in-game ping before and after each change. If latency spikes when your connection is busy, investigate router queue management; if it stays high on a quiet wired connection, check server distance, ISP routing and game-service issues. Faster internet speeds alone do not guarantee lower ping. Start with the quickest fixes Start with changes that are easy to reverse and help separate local problems from distant ones. Record a baseline and change one variable at a time, rather than applying a bundle of “gaming tweaks” whose effects you cannot distinguish. Record your in-game ping. Note the selected region, whether you use Wi-Fi or Ethernet, and whether the reading stays steady or jumps. Keep the game's network display visible during your comparisons. Pause heavy transfers. Stop launcher downloads, cloud uploads and other large transfers you control. Ask other household users whether they can pause heavy activity briefly. Test Ethernet. Connect directly to your router if practical, and confirm your device uses that connection rather than Wi-Fi. Compare the same game region under otherwise similar conditions. Compare available game regions. Start with nearby options, then check their displayed latency and stability during play. Keep the region that performs best for your connection, not simply the one with the closest name. A steadier connection after pausing an upload points toward competition for connection capacity; an improvement on Ethernet points toward your wireless link. Keep useful changes, but move to the next diagnostic when a change makes no clear difference. Repeat a promising result before making it permanent. Game and network conditions change, so an isolated better match is less useful than a consistent improvement under comparable conditions. Check whether the problem is actually ping Ping is the round-trip network delay between your device and a destination. Jitter is variation in that delay, packet loss means some transmitted data does not arrive, and FPS, or frames per second, describes rendering performance rather than network latency. Problem What you may notice Next useful check High ping Actions take longer to receive a server response, even when movement looks smooth Compare game regions and quiet wired results Jitter Response timing changes, with intermittent delay spikes Compare Wi-Fi with Ethernet and idle with busy conditions Packet loss Missing updates, interrupted movement or sudden position corrections Check the game's loss display and compare local connection types Low FPS Choppy animation or uneven visual performance while network readings remain steady Investigate rendering performance separately from ping Use the game's own ping display as your gaming baseline. Record the region and compare similar play conditions, including whether household traffic is active. Symptoms can overlap, so use the readings alongside what you see rather than diagnosing the cause from stuttering alone. A speed test can legitimately show a different ping because it usually measures a different server and route. A low speed-test reading does not invalidate high in-game latency, and a high reading does not identify the game's problem by itself. For example, if the game feels choppy but its ping and loss readings remain stable, investigate rendering rather than stacking network changes. Graphics adjustments may help visual smoothness, but they are not a direct fix for network round-trip delay. Test Ethernet, then improve Wi-Fi if needed Ethernet is the useful first local-network comparison in most cases. Wi-Fi signal strength and interference can cause latency problems, while Ethernet provides a direct connection to your router; the comparison helps reveal whether wireless conditions are contributing. Keep the game region unchanged. Avoid comparing a wireless match in one region with a wired match in another. Connect directly to the router. Confirm Ethernet is the active connection. If necessary, temporarily disconnect Wi-Fi for the test, then restore your preferred connection afterward. Compare both average delay and spikes. A similar average with fewer spikes is still a useful result. Check packet loss too, if the game displays it. Follow the result. If Ethernet removes the problem, focus on Wi-Fi placement and interference. If it does not, continue to background-traffic and route checks before buying equipment. Without an Ethernet option, move your device closer to the router and repeat the comparison. Improvement there makes wireless signal conditions a useful area to investigate, although this test does not isolate Wi-Fi as cleanly as a wired comparison. Compare available Wi-Fi bands rather than assuming the higher-frequency option always wins. The 5 GHz band can face less interference than 2.4 GHz, but its shorter range makes it better suited to nearby devices. Try both from your actual gaming location, and keep the band that gives steadier results there. Reduce lag spikes when your connection is busy Latency that rises during downloads or uploads points toward competition for connection capacity and queueing under load. Background updates and cloud backups can create latency spikes, even when you did not deliberately start a transfer. Compare quiet and busy conditions. Outside an active match, observe latency while the connection is quiet, then during an ordinary download or upload. Keep the destination and connection type unchanged. Pause likely contributors. Check cloud backups, launcher downloads and transfers on other devices. Coordinate with household users rather than disconnecting their devices without warning. Look for queue-management controls. If busy conditions repeatedly cause spikes, consult your router's documentation for Smart Queue Management or QoS, meaning Quality of Service. Change settings safely. Only administer a router you are authorized to manage. Save the existing settings, follow instructions for your router and connection, and revert if latency, stability or throughput worsens. Resume paused transfers. Once testing is complete, restart backups and updates. Schedule heavy transfers away from gaming if pausing them consistently helps. Bufferbloat is excessive queueing under load: game traffic waits behind other traffic instead of moving promptly through the connection. Queue management aims to control that waiting. Simply labeling gaming traffic “high priority” is not the same as controlling queue buildup, and router controls vary enough that a universal setting is not appropriate. The number of connected devices alone does not establish congestion. Several idle devices may matter less than one active upload, so test actual traffic rather than removing devices at random. More bandwidth can reduce competition when capacity is limited, but raw speed does not directly determine ping. Consider additional capacity only when your normal traffic repeatedly overwhelms the connection, not because your quiet-connection ping looks high. Choose a game region by measured latency Nearby game regions usually offer lower latency, but a slightly farther region can perform better when the nearby server is congested. Geography is a useful starting point, not a substitute for measuring your actual connection. Compare nearby regions first. Use the game's region selector or latency display where available. Note which region it selects automatically. Check stability during play. Compare actual in-game ping, spikes and loss, not just a single matchmaking estimate. Confirm the party's region. When playing with distant friends, check which region the party uses. A region suitable for another player may be farther from you. Check service status for isolated problems. If only one game or region performs badly, consult that game's service-status information before changing your whole network. For example, a nearby region might give the best results when quiet but become less stable during busy periods. If another available region consistently performs better under comparable conditions, use that result to guide your choice. Keep the comparison fair by leaving your local connection and background traffic unchanged. Otherwise, a region change and a paused download can look like one improvement even though you do not know which mattered. The in-game display reflects your live connection to that specific server, so check it again after joining. A region label alone does not tell you how the current match will perform. Test alternate routes without weakening security An alternate route is an optional experiment after local fixes, not a guaranteed ping reduction. A tunnel can improve or worsen latency because it changes the route and can add extra routing. Keep the destination fixed. Compare the same game region with similar background traffic. Changing both the route and region makes the result difficult to interpret. Use permitted configurations. If you already use a privacy tunnel, compare routing options allowed by its controls and any organizational policy. Do not defeat a required kill switch to run the test. Understand a bypass before using it. Split tunneling can send selected traffic outside the tunnel. That means game traffic may leave outside your chosen privacy path. Keep security protections enabled. Do not disable firewalls or certificate validation, or open ports merely to try to lower ping. Restore the original configuration if results worsen. Keep an alternate route only if repeated comparisons show a useful improvement and its privacy tradeoff is acceptable. A different route may help, but results are connection-specific. Better results through a tunnel suggest that the changed path may suit that destination better; they do not prove your ISP is throttling game traffic. If bypassing the tunnel conflicts with a kill switch, required privacy controls or organizational policy, leave those protections in place. Continue with region comparisons and connection diagnostics instead of weakening security for an uncertain performance benefit. Know when the fix is outside your home High ping that persists on a quiet wired connection shifts attention toward server distance, routing, congestion or game-service conditions. Your ISP may need to investigate connection problems or outages outside your control. Repeat quiet wired tests at different times. Keep the game region fixed and note whether the issue is persistent or follows a time-of-day pattern. Check game-service notices. A problem confined to one game or region is a reason to investigate that service before replacing home equipment. Prepare a useful support report. Include the game and region, timestamps, in-game latency, observed packet loss, connection type and changes already tried. Note which comparisons improved the result and which did not. Contact the appropriate support team. Ask game support about game-specific issues and your ISP about persistent connection problems. Describe the pattern rather than declaring a cause you have not isolated. Evening-only problems suggest a congestion pattern, but they do not prove throttling or identify where the congestion occurs. Likewise, a speed-test result is only a rough baseline for gaming because it measures another destination. Replace equipment only when comparisons point to a local bottleneck, and consider a plan change when normal traffic exceeds available capacity. Neither purchase is a reliable answer to unexplained high idle ping. Distance and network routes constrain round-trip delay. More Mbps can provide room for simultaneous traffic, but it cannot by itself promise a shorter trip between your device and the game server. On this page Start with the quickest fixes Check whether the problem is actually ping Test Ethernet, then improve Wi-Fi if needed Reduce lag spikes when your connection is busy Choose a game region by measured latency Test alternate routes without weakening security Know when the fix is outside your home Author doxx.net Editorial Category Networking Published 6 Oct 2026 Reading time 10 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 Networking Can You Access Your NAS From Anywhere? Yes, you can access your NAS from outside your home network once you configure remote access. doxx.net Editorial 11 min read 6 Oct 2026 Networking How to Change Your Wi-Fi Channel Change your router’s Wi-Fi channel, choose settings for each band, test performance, and learn what to do if channel controls are locked. doxx.net Editorial 6 min read 6 Oct 2026 Networking How to Find the IP Address of a Printer Find your printer's IP address using its display, a network report, Windows or Mac settings, or your router. Confirm the address before printing. doxx.net Editorial 10 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## How to Reduce Packet Loss: Step-by-Step Fixes URL: https://www.doxx.net/insight/how-to-reduce-packet-loss/ Product Resources Pricing Get Started Insights How to Reduce Packet Loss Reduce packet loss with controlled Wi-Fi, Ethernet and congestion tests. Learn how to measure results, apply targeted fixes and escalate persistent issues. On this page Start with reversible fixes and retest Measure loss while the problem is happening Separate device and Wi-Fi faults from upstream problems Reduce competing traffic before tuning QoS Update or replace only the components your tests implicate Test private connections without exposing your services Escalate persistent loss with before-and-after results To reduce packet loss, pause bandwidth-heavy background transfers, compare Wi-Fi with an Ethernet connection, and check cables and router ports. Measure loss before and after each change. If it persists, test for congestion, update supported network drivers and router firmware, and investigate the affected service or ISP connection. Apply fixes to the segment your tests implicate rather than assuming a faster internet plan will solve it. Start with reversible fixes and retest Start with changes you can undo easily, then repeat the activity that showed the problem. Keep the application, destination and network load as similar as practical so the comparison tells you something useful. Record the symptom. Note whether you see broken voice, stalled video, game disconnects or a packet-loss reading inside the application. Record when it happens and whether other devices are affected. Pause competing transfers. Stop downloads, uploads, cloud backups and other nonessential traffic you control. Closing bandwidth-heavy background applications is a practical first step when congestion may be involved. Compare Wi-Fi with Ethernet. Test the same device and application over a wired connection. Improvement on Ethernet points toward Wi-Fi interference, distance or weak signal, rather than immediately implicating your internet service. Check the physical connection. Reseat the cable, then substitute a known-good cable or another suitable router port. Change these separately so you can tell which substitution helped. Restart your own router if practical. Coordinate with other users first because a restart interrupts their connections and your remote sessions. Restarting means rebooting the device, not using its factory-reset function, which erases configuration. An improvement gives you a useful lead, not necessarily a confirmed root cause. If pausing transfers helps, investigate load; if Ethernet helps, investigate Wi-Fi. Unchanged results mean you should establish the baseline below before making broader changes. Measure loss while the problem is happening Packet loss means packets fail to reach their destination; latency is the time traffic takes to travel, and jitter is variation in that delay. A connection can have high latency or uneven timing without showing packet loss, so record these separately. Start with the affected application. Enable its network statistics if available and watch them while the symptom occurs. This keeps the measurement tied to the traffic you actually need to fix. Choose responding comparison targets. Test your local gateway, a public endpoint and the affected endpoint where permitted. Comparing multiple targets, including the gateway and application endpoint, helps separate local connectivity from broader problems. Run a short Windows sample. In Windows Command Prompt, the following command sends 50 pings to Cloudflare’s server: ping -n 50 1.1.1.1 For your gateway, find the default gateway address in your active network adapter’s connection details. Replace YOUR_GATEWAY_ADDRESS below with that verified address: ping -n 50 YOUR_GATEWAY_ADDRESS Ordinary ping needs no administrator elevation and changes no settings, so there is nothing to restore afterward. Run it only against destinations you are authorized to test; press Ctrl+C to stop it. Repeat and record. Save the destination, time, connection type, sent and received counts, reported loss and latency. Compare samples during symptoms and quiet periods, and extend observation when the problem is intermittent. Ping measures replies to diagnostic traffic, not every packet used by your application. A problem limited to a game or real-time application may not show up in ping, while a target that does not answer may simply reject diagnostic requests. Treat endpoint loss alongside application symptoms as a stronger reason to investigate than either result alone. Separate device and Wi-Fi faults from upstream problems The most useful next test follows the pattern of affected devices and destinations. Compare results under similar conditions, and treat each pattern as a lead rather than proof. Observed pattern Likely area to investigate Next test Loss on Wi-Fi improves on Ethernet Wireless signal, interference or the wireless adapter Repeat the same application test near the router, then compare another device Loss affects only one device That device’s adapter, software or local connection Substitute its cable and port separately, then compare another device on the same network Multiple internet targets show loss, but the responding gateway stays clean Shared internet connection or paths beyond the gateway Repeat wired tests on another device and compare quiet with busy periods Only one application or destination is affected Application, destination service or its path Check that application’s statistics and service status, then test other destinations Wi-Fi interference becomes a useful lead when wired tests improve under comparable conditions. When loss persists on Ethernet, device, cable, port and upstream checks become more useful. Keep substitutions controlled: changing the device and cable together makes it harder to know which change mattered. Traceroute or MTR can optionally show where diagnostic responses stop or slow down, but they do not automatically identify a faulty router. Some routers limit how often they send ICMP TTL Exceeded responses, so an isolated intermediate-hop timeout can reflect diagnostic-response rate limiting rather than lost forwarded traffic. Look for persistent destination loss and matching application symptoms before blaming a router or ISP. Keep your protective router and firewall in place during testing; connecting an unprotected device directly to a modem is not a necessary troubleshooting shortcut. Reduce competing traffic before tuning QoS Loss that appears under load makes traffic reduction a useful next step. Excessive traffic can overload a network and cause packet loss, but increased delay during a busy period is not itself proof that packets are missing. Compare quiet and busy conditions. Repeat your application and endpoint tests with bulk transfers paused, then compare them with the conditions that normally trigger the issue. Cap or schedule nonessential traffic. Move cloud backups and large transfers away from calls or other real-time work. Include uploads as well as downloads when checking what competes for the connection. Consider supported QoS or queue management. Quality of Service, or QoS, allocates constrained capacity among traffic types; it does not create bandwidth. If your router supports it, follow its documented configuration and prioritize the real-time traffic you need. Save, change and compare. Record the original settings, change a policy, then rerun the same tests. Compare application network statistics with QoS enabled and disabled, and revert if performance worsens. If stopping a backup improves both the application and its loss reading, scheduling or limiting that transfer is a targeted response. If only latency improves, you have reduced delay but have not demonstrated reduced packet loss. When loss persists during quiet periods, cable, port and adapter substitutions are more useful than repeatedly adjusting traffic priorities. Update or replace only the components your tests implicate Software updates and hardware replacement are most useful after controlled tests narrow the problem to a device or link. Replacing a router before checking the cable, adapter and affected destinations can leave the actual fault untouched. Follow the substitution results. If a known-good cable repeatedly removes the symptom while the original cable brings it back, replace that cable. Apply the same reasoning to a port or adapter, and confirm the result across comparable tests. Use supported software channels. Obtain network drivers and router firmware from the relevant vendor’s supported distribution channel. If symptoms began after a driver update, consider the vendor-supported rollback route and compare the previous version. Prepare for router changes. Proceed only if you own the router or have administrator permission, have local access, and have saved its configuration. Read the manufacturer’s recovery instructions before updating, and do not interrupt power or the update process. Follow firmware instructions exactly. Manufacturer guidance may require additional steps after an update, including restoring defaults. Treat that as a specific maintenance requirement, not a reason to factory-reset every connection with packet loss. Inspect documented interface counters if available. Technical users can check whether interface errors rise during the symptom. Interpret those counters using the device documentation and alongside substitution results, not as a diagnosis by themselves. After each update or replacement, repeat the original test before changing anything else. If the result is unchanged, return to the other implicated areas rather than continuing to replace parts. Blanket TCP tuning, DNS flushing, factory resets and disabling firewalls are not routine packet-loss fixes; DNS changes do not generally repair loss on an already established connection. Test private connections without exposing your services A private connection adds a path that you should distinguish from the underlying internet connection. Keep access controls intact while testing: making a private service publicly reachable changes its exposure, not just the quality of the comparison. Test the underlying connection where policy permits. Use a responding public endpoint through an authorized route that lets you observe the underlying connection. Do not disconnect a required protected connection or disable a kill switch to obtain this result. Test the private endpoint through its authorized path. Use the affected application’s statistics and supported diagnostics. Keep firewall rules and private-service access restrictions unchanged. Label the destinations and paths clearly. A public endpoint test and a private-service test reach different destinations, so they are not a like-for-like route comparison. A clean public test narrows the investigation but does not prove the route to the private service is healthy. Investigate tunnel-specific behavior when indicated. If only the tunneled application fails, consult the tunnel provider’s supported diagnostics and MTU guidance. MTU means maximum transmission unit, the largest packet size allowed on a link; tunnel-related loss can involve server load, transport behavior or MTU mismatches. If policy prevents a separate underlying-connection test, ask the network administrator for an approved diagnostic method. Do not guess a universal MTU or publish a self-hosted service just to make it easier to probe. A private or encrypted connection does not repair damaged cables, faulty Wi-Fi or an unavailable remote service. Escalate persistent loss with before-and-after results Broadly affected destinations justify investigating the shared connection; a single affected service calls for checking that service and its path first. A remote game-server problem may be beyond anything you can fix locally, and the same distinction matters when choosing whom to contact. Check the affected service’s status. An outage or service incident can explain application symptoms even when your other connections work. Avoid changing the whole network to address a destination-specific failure. Contact the appropriate operator. For repeated loss across internet destinations after local checks, contact your ISP or network administrator. For a problem confined to a service or private path, start with that service operator or the administrator responsible for the path. Provide a reproducible record. Include timestamps and timezone, connection type, affected applications, repeated endpoint results, and the cable, port, device or software changes already tried. Distinguish measured packet loss from latency and application disconnects. Describe route findings cautiously. Report a suspected location, not a definitive fault or direction of loss based on an intermediate-hop timeout. Before posting logs publicly, redact account details, private addresses and sensitive service names. After a local change or operator intervention, rerun the baseline with the same targets and durations under comparable load. Check the affected application as well as ping, then monitor during the conditions that previously triggered the problem. A single clean sample shows improvement during that sample, not a permanent fix. On this page Start with reversible fixes and retest Measure loss while the problem is happening Separate device and Wi-Fi faults from upstream problems Reduce competing traffic before tuning QoS Update or replace only the components your tests implicate Test private connections without exposing your services Escalate persistent loss with before-and-after results Author doxx.net Editorial Category Networking Published 6 Oct 2026 Reading time 10 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 Networking Can You Access Your NAS From Anywhere? Yes, you can access your NAS from outside your home network once you configure remote access. doxx.net Editorial 11 min read 6 Oct 2026 Networking How to Change Your Wi-Fi Channel Change your router’s Wi-Fi channel, choose settings for each band, test performance, and learn what to do if channel controls are locked. doxx.net Editorial 6 min read 6 Oct 2026 Networking How to Find the IP Address of a Printer Find your printer's IP address using its display, a network report, Windows or Mac settings, or your router. Confirm the address before printing. doxx.net Editorial 10 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## What Is Network Connectivity? How to Check It URL: https://www.doxx.net/insight/network-connectivity/ Product Resources Pricing Get Started Insights Network connectivity: how it works and how to check it Network connectivity lets devices exchange data. Learn how wired and wireless links work and how to check reachability, DNS and application access. On this page A connection means you can exchange data How data reaches another device Wired and wireless ways to connect Reachability is not the same as performance Check the path one stage at a time Keep private access separate from public reachability Network connectivity is the ability of devices to communicate and exchange data across a network using wired or wireless connections. It requires a working connection medium, compatible protocols, and appropriate addressing and network configuration. Being connected to Wi-Fi or Ethernet does not by itself mean you can reach the internet or a particular service. A connection means you can exchange data Connectivity describes communication with a destination, not merely a connected-status icon. Your laptop might reach a local printer while internet access is unavailable. In that situation, the connection between the laptop and printer works, even though the path to a remote website does not. A local connection usually supports communication within the local network; internet access also requires a working path beyond that network when the destination is remote. Devices exchange information through hardware and software using a physical or wireless medium. That connection is part of the path, not proof that every destination is reachable. When checking connectivity, name both endpoints and the task: “Can this laptop print?” is more useful than “Is the network working?” It separates a working local connection from an unavailable remote destination. How data reaches another device A network adapter connects your device to the communication medium, such as a cable or wireless signal. Protocols are the rules devices follow to exchange and interpret data. Network communication carries data in packets, which are smaller units sent toward a destination. For a simplified webpage request, DNS resolves the website’s hostname into an IP address. The hostname is the readable name, while the IP address identifies a destination for network communication. Addressing and naming identify devices and resources, so a working connection still needs the right destination information. Switches carry traffic within a local area network, or LAN, such as the network connecting your home devices. Your device’s address and subnet mask help it determine whether the destination is local; the default gateway is the router used to reach other networks. Routers read each packet’s destination IP address and use a routing table to choose where to forward it. A wide area network, or WAN, connects networks across a wider area, and a remote webpage request needs a path beyond your LAN. The destination service must also accept and handle the request. Reaching the server’s network address does not establish that its website is available or that your account may use it. This distinction matters when one application fails while other traffic works: the problem may be at the service rather than the local connection. Wired and wireless ways to connect Network connections can be wired or wireless. Wired connections usually suit fixed devices, while wireless connections suit mobility or situations where avoiding a cable is the priority. The choice concerns the link you need, not a universal ranking of speed or security. Connection method Typical use Practical limitation Ethernet Fixed local devices connected through copper or fiber Requires a suitable cable connection and compatible equipment Wi-Fi Mobile devices accessing a local network Needs a working wireless link; joining Wi-Fi does not establish internet access Bluetooth Communication between nearby devices A nearby-device connection does not itself provide a path to remote services Cellular Wider-area access for mobile devices Requires available coverage and an active service connection Satellite Wider-area access through a satellite connection Requires suitable equipment and a working service connection Ethernet, Wi-Fi, Bluetooth, cellular and satellite are all ways to establish network connectivity. They can serve different parts of a communication path rather than replace one another directly. For example, your laptop may use Wi-Fi to reach your router, while your internet service provider supplies the path beyond your local network. A working Wi-Fi link cannot compensate for a failed onward connection. Equally, working internet service cannot help a laptop that has lost its local link to the router. Reachability is not the same as performance Reachability asks whether communication with a destination succeeds. Performance asks how well that communication supports your task. Bandwidth describes capacity for data flow, while latency describes response delay. Throughput is the transfer rate you actually achieve, which is distinct from the connection’s capacity. Packet loss means some transmitted packets fail to arrive. Tracking packet loss, latency and bandwidth usage helps diagnose network problems, but no single measurement describes every application’s experience. A file transfer benefits from sustained throughput because the task is to move data. A voice or video call is also sensitive to delay and loss because the conversation needs timely delivery. A connection can therefore transfer files successfully while still making a call feel unreliable. A ping availability check sends an Internet Control Message Protocol, or ICMP, echo request to a destination. A successful reply establishes only the tested path and response, not that a website, file transfer or call will work well. Test the affected application and assess the measurements against its needs rather than applying a universal acceptable-value threshold. Check the path one stage at a time Start with the affected device and destination, then work outward from the local link. Comparing another device or destination helps separate a device-specific problem from a shared network or service problem. Identify what fails. Record the affected device, destination, application and visible error. If another device reaches the same destination, that device’s path works, but yours still needs investigation. If both fail, compare a different destination to see whether the failure is specific to one service or affects broader access. Inspect the local link. Check that the cable is connected or that the device has joined the intended Wi-Fi network. A connected status establishes the reported link state, not internet or application access. If the link is absent, inspect the connection equipment; compare with another authorized device using the same local network. Review addressing in network settings. Check the assigned IP address, subnet mask and default gateway against the network’s intended configuration, because correct IP configuration matters for connectivity. Matching settings remove an obvious configuration mismatch, but values being present does not prove they are correct. Missing or unexpected settings suggest an addressing problem; compare the configuration pattern with a working device without copying its individual address. Check local reachability. Try an approved local destination, such as your router or a known local service. A response shows that the tested local communication works; failure suggests a local-path, destination or filtering issue. Compare another local destination, and remember that an unanswered ping can reflect filtering rather than an outage. Separate external reachability from name resolution. Check an authorized external destination and whether DNS resolves the hostname you need. A successful external check establishes that tested remote path, while a successful lookup establishes name resolution, not service availability. If local checks work but remote checks fail, investigate the onward path; if resolution fails, compare another hostname before treating DNS as the cause. Test the actual application. Open the affected service or repeat the operation that failed. Success establishes that operation works under the current conditions; failure after earlier checks pass shifts attention toward the service, its configuration or its access requirements. Compare the same application on another authorized device, or another service from the affected device. Review firewall rules and access policies when legitimate traffic appears blocked, rather than disabling protections as a test. A restriction may be intentional. If configuration changes are necessary, obtain authorization, record the original values and arrange a way to restore access before making the change. Keep private access separate from public reachability Successful connectivity establishes communication, not confidentiality or permission. A reachable service may still need encrypted transport, identity checks and restrictions on who can use it. Access controls limit permission according to credentials or factors such as device or location. For a self-hosted service, define which devices or identities should have access before arranging the connection. If an agent needs to use that service, give it the access required for its task rather than assuming every connected participant should be allowed. Retain application authentication and certificate validation, and prefer private access for remote administration instead of exposing it directly to the public internet. Blocked traffic is a connectivity fault when it prevents intended access; it is the correct result when an access policy excludes the device or service. Verify both outcomes using approved tests: an allowed device or identity should reach the service, and an excluded one should not. If the result differs, check the relevant access policy before changing the network path. On this page A connection means you can exchange data How data reaches another device Wired and wireless ways to connect Reachability is not the same as performance Check the path one stage at a time Keep private access separate from public reachability Author doxx.net Editorial Category Networking Published 6 Oct 2026 Reading time 08 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 Networking Can You Access Your NAS From Anywhere? Yes, you can access your NAS from outside your home network once you configure remote access. doxx.net Editorial 11 min read 6 Oct 2026 Networking How to Change Your Wi-Fi Channel Change your router’s Wi-Fi channel, choose settings for each band, test performance, and learn what to do if channel controls are locked. doxx.net Editorial 6 min read 6 Oct 2026 Networking How to Find the IP Address of a Printer Find your printer's IP address using its display, a network report, Windows or Mac settings, or your router. Confirm the address before printing. doxx.net Editorial 10 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## What Is an On-Path Attack? URL: https://www.doxx.net/insight/on-path-attack/ Product Resources Pricing Get Started Insights On-path attacks: how interception works and how to protect your traffic An on-path attacker intercepts traffic between devices. Learn how attacks work, what HTTPS protects, which warning signs matter, and how to respond. On this page Interception starts with a position in your traffic path Common ways an attacker gets between you and a service What an attacker can see when HTTPS is working Choose protection for the communication you need to keep private Warning signs are reasons to investigate, not proof Respond from a trusted connection An on-path attack occurs when an attacker gains a position between communicating devices and intercepts, redirects, or alters their traffic. It is commonly called a man-in-the-middle (MITM) attack. Being on the path does not automatically let an attacker read encrypted content: properly validated HTTPS/TLS limits what they can see and change, although traffic metadata can remain visible. Interception starts with a position in your traffic path The basic flow is your device → attacker-controlled intermediary → intended service. The intermediary can forward your requests and the service’s responses, allowing the connection to keep working while traffic passes through the attacker’s position. For example, a rogue hotspot can provide an apparently usable connection without being a trustworthy place to send unprotected information. A passive on-path attacker monitors communication without changing it. An active attacker attempts to alter the exchange, such as redirecting a request or modifying unprotected content. The distinction matters because an attack does not need to produce a visible failure: observation alone can threaten privacy when the traffic exposes sensitive information. “On-path” emphasizes the attacker’s position somewhere along the communication route, not necessarily beside your device. “MITM” usually names the same attack category. Neither term means that the attacker has automatically defeated encryption, taken over your account, or compromised either endpoint. For your privacy, separate access to the traffic path from access to the message itself. An attacker might observe encrypted traffic without learning its contents, while ordinary HTTP can expose the information being exchanged. A phishing page, compromised account, or infected device is not by itself evidence of an on-path attacker, even though those problems can also put your information at risk. Common ways an attacker gets between you and a service Some techniques establish an interception position; others exploit one that already exists. Rogue Wi-Fi and local-network redirection can place traffic under an attacker’s control. SSL stripping is different: it attempts to keep your side of an intercepted connection unencrypted rather than decrypting a working HTTPS session. Mechanism Where it acts Protection it tries to defeat Rogue Wi-Fi The wireless network you join Your assumption that the access point provides a trustworthy route. Attackers can exploit weak wireless security to intercept activity, but controlling the hotspot does not itself defeat validated HTTPS. ARP spoofing A local network that uses Address Resolution Protocol The local mapping between network addresses and devices. An attacker falsely associates their device’s address with the gateway’s address, redirecting local traffic through their device. DNS spoofing The process that translates a hostname into a network address Your expectation that a lookup leads to the intended destination. Manipulated responses can redirect users toward malicious websites, but redirection alone does not supply a valid certificate for the intended HTTPS hostname. SSL stripping The connection between your device and an intermediary The transition from an insecure connection to HTTPS. The intermediary uses HTTPS toward the service while serving HTTP to you, leaving the victim-facing connection in plaintext. ARP spoofing concerns the next destination on your local network. DNS spoofing concerns the address returned for a name. Neither should be treated as a universal explanation for interception: a changed DNS answer can be legitimate, and not every malicious DNS redirection involves an attacker sitting on your existing traffic path. Session-token theft is a possible consequence of exposure, not a requirement for getting on the path. A token represents an authenticated session, so an attacker who obtains a usable token may not need to steal the password as well. The important question is whether sensitive traffic or session information became accessible, not merely whether an unfamiliar intermediary existed. What an attacker can see when HTTPS is working Ordinary HTTP traffic is plaintext on the connection. An on-path attacker can read intercepted content and may alter it. Properly validated HTTPS/TLS protects the content between the communicating endpoints when those endpoints and their trust configuration remain intact. Capturing encrypted packets is not the same as obtaining their plaintext. Even when encryption holds, an attacker can observe which servers you contact, when, and how frequently. That distinction is important for privacy: the contents of a conversation may remain confidential while its destination and pattern of activity remain visible. SSL stripping avoids HTTPS on your side of the connection; it does not decrypt an already established, correctly validated TLS session. You might be communicating with the intermediary over HTTP while the intermediary separately communicates with the intended service over HTTPS. The service’s encrypted connection therefore does not protect the plaintext leg between you and the attacker. HSTS limits this downgrade by directing the browser to use HTTPS. Its protection applies when the browser already knows an applicable policy, including through preloading; a first visit can remain exposed when neither a learned nor a preloaded policy applies. Check the connection you actually have, rather than assuming that a service’s support for HTTPS means every visit used it. Certificate validation is part of this protection, not an optional obstacle. Accepting a certificate warning can undermine the authentication that tells your device which service it is communicating with. A valid HTTPS connection authenticates the hostname and protects the connection’s content; it does not establish that the website’s operator is honest or conceal every traffic metadata field. Choose protection for the communication you need to keep private Match the protection to the information you want to keep private and the endpoints that should receive it. Browsing, private conversations, and connections to self-hosted services have different boundaries. A protected route is useful, but it does not replace verification of the service or control over who can use it. Communication Relevant control Protected boundary What you still need to check Browsing HTTPS/TLS with proper certificate verification Content between your browser and the authenticated service The hostname is the one you intended, validation succeeds, and you are not using an unexpected HTTP connection. HTTPS does not establish the website’s honesty. Private messages and calls End-to-end encryption for sensitive communication Message or call content between the participating endpoints The participants and devices are the intended ones. Content remains accessible at the endpoints after decryption. Device-to-service or agent-to-service connections Authenticated encrypted connections plus appropriate access controls Traffic between the connecting device or agent and its intended service The service identity validates, credentials are protected, and permissions fit the task. Network access alone should not authorize every action. For private services, authentication deserves the same attention as encryption. Digital certificates support secure authentication through PKI, but the connection must still validate the identity you intended to reach. An encrypted connection to the wrong service does not solve the original privacy problem. Adding a private network or another encryption layer can protect a communication boundary without protecting everything beyond it. Application authentication and access controls still matter. No transport layer protects data after a compromised endpoint decrypts it, and no single control prevents every form of interception or exposure. Multi-factor authentication helps reduce many account-takeover risks, but it is not a universal defense against session theft. An intercepted session token can let an attacker impersonate an authenticated user without the password when the application permits its replay. Treat protection of active sessions as a separate requirement from protection of the initial login. Warning signs are reasons to investigate, not proof A warning can establish that something is wrong without establishing why. Certificate problems, unexpected plaintext connections, and unexplained redirects deserve attention because they can affect the protection you expected. Stop sensitive activity while you investigate rather than trying to make the warning disappear. Observation What it establishes Next action Certificate warning Certificate validation failed. Warnings may report an expired or untrusted certificate; interception is only one possible cause. Do not bypass the warning. Check the intended hostname and retry from an independently trusted connection. Unexpected HTTP connection The current connection lacks HTTPS protection. It does not establish whether a downgrade attack occurred. Stop entering sensitive information. Use the service’s known HTTPS address and confirm that validation succeeds. Redirect or hostname change Your browser reached a different address or name. The reason may be legitimate or malicious. Compare the destination with the address you intended to use. Avoid signing in until you understand the change. Unexpected local ARP mapping The observed local address mapping differs from what you expected. A legitimate network change remains possible. If you administer the network, compare it with the known gateway configuration; otherwise contact its administrator. Changed DNS answer A lookup returned a different destination. Legitimate infrastructure changes can cause this. Check with the service or network administrator before treating the change as malicious. Network slowdown Performance changed. Latency alone is weak evidence of interception. Compare it with normal behavior and look for corroborating observations rather than diagnosing an attack from delay alone. Certificate expiry and configuration mistakes can produce warnings without an attacker. Similarly, DNS changes and redirects can be part of ordinary service operation. The useful question is what changed, whether the change is expected, and whether the connection still authenticates the intended service. For technical investigation, timing changes are noisy and work best alongside other indicators and a baseline. An isolated slow connection offers little diagnostic value. Normal-looking traffic is also not proof that interception is absent, because a passive observer need not alter the exchange and a forwarding intermediary can keep it functioning. Respond from a trusted connection Act promptly when you suspect an on-path attack, but distinguish containment from diagnosis. You can stop further exposure before you know whether the cause is interception, a service error, or a device problem. Stop entering secrets. Pause logins, payments, private messages, and other sensitive activity on the affected connection. Do not accept certificate errors to continue, because doing so removes an important identity check. Leave the suspect network. Disconnect and use an independently trusted connection. Simply reconnecting to the same hotspot does not give you an independent comparison. Record what you observed. Note the hostname, the warning or unexpected behavior, and the time. Keep the record focused on your own connection; you do not need to collect other people’s traffic. Verify the service through a known address. Use an address you already trust rather than following the suspicious redirect. If certificate validation still fails, stop and contact the service administrator through an established channel. Protect potentially exposed accounts. From a trusted device and connection, change passwords that may have crossed an unprotected connection and revoke active sessions where the service allows it. Revocation matters because a stolen session token may permit impersonation without another password login. Review activity and report the problem. Check affected accounts for unfamiliar sessions or actions. Contact the account provider or network administrator with the hostname, timing, and warning details so they can investigate the relevant service or network. A warning that disappears on another network narrows the investigation toward differences between the connections, but it does not prove an attack occurred. A warning that persists warrants checking the device and the service as well. Resume sensitive activity only when the intended connection validates successfully, not merely because the page loads again. On this page Interception starts with a position in your traffic path Common ways an attacker gets between you and a service What an attacker can see when HTTPS is working Choose protection for the communication you need to keep private Warning signs are reasons to investigate, not proof Respond from a trusted connection Author doxx.net Editorial Category security Published 6 Oct 2026 Reading time 10 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 security Blocking Encrypted DNS Traffic: What It Means and What to Check Learn what an encrypted DNS warning means, how blocking affects privacy, and how to check device settings, network controls and DNS fallback. doxx.net Editorial 6 min read 6 Oct 2026 security AI Browser Agent Security: Current Risks and Practical Controls AI browser agents remain vulnerable to prompt injection. Learn how scoped access, execution controls, approvals and recovery tests limit exposure. doxx.net Editorial 9 min read 6 Oct 2026 security EAP methods for Wi-Fi: what they mean and which to choose Understand EAP-TLS, PEAP and EAP-TTLS, match your enterprise Wi-Fi profile, validate server certificates and troubleshoot authentication failures. doxx.net Editorial 10 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Prevent LLM Access to Confidential Development Data URL: https://www.doxx.net/insight/prevent-llm-from-accessing-confidential-data-in-development/ Product Resources Pricing Get Started Insights How to Prevent an LLM from Accessing Confidential Development Data Keep confidential data out of LLM context with isolated workspaces, sanitized inputs, retrieval authorization, tool permissions and boundary tests. On this page Define what the assistant must never receive Give the assistant a sanitized development workspace Remove sensitive content before prompts, indexing and training Enforce permissions on retrieval and tool execution Keep sessions, caches and derived data isolated Restrict network reachability without confusing it with data access Verify denied access with harmless test data If confidential data has already reached the model Prevent an LLM from accessing confidential development data by withholding that data from its context and restricting the permissions of the software running it. Use a sanitized development workspace, synthetic test data, narrowly scoped agent credentials, authorized retrieval and externally enforced tool permissions. Keep secrets out of prompts, logs and training datasets. A “never reveal secrets” instruction, a training opt-out or an encrypted connection does not prevent the model from processing data you send it. Define what the assistant must never receive Start with the data boundary, then choose controls for each route into the assistant. Confidentiality checks must cover proprietary content as well as personally identifiable information, or PII. Classify prohibited data. Include credentials, customer records, proprietary source code and unreleased designs. Decide which material can appear in an approved development copy and which must remain inaccessible. Identify entry points. A coding assistant may read workspace files or terminal output. An application agent may retrieve documents, query databases or call tools using credentials supplied by its runtime. Choose enforcement before model context. Apply file isolation, ingestion checks, retrieval authorization or tool-execution checks before content reaches the model. Grant access only to data needed for the specific user or process. Use a small inventory to make those boundaries explicit: Entry point Confidential content at risk Control before model access Prompts Pasted records or designs Review and sanitize input Files Credentials or restricted code Approved workspace and restricted mounts Terminal output Environment values or diagnostic records Restrict commands and sanitize results Connectors Private documents or database rows User-specific authorization Logs Prompt traces and tool results Sanitize before storing or reusing Workspace and runtime restrictions are the starting point for coding assistants. Retrieval authorization and tool gating become essential when an assistant has connectors, database access or execution tools. Give the assistant a sanitized development workspace Give the assistant an allowlisted working copy containing only approved source, documentation and synthetic test fixtures. This is easier to reason about than a sensitive workspace with exclusions added afterward. Build the approved copy. Include the files needed for the task, not the entire development environment. Keep production exports, private keys, .env files and confidential documents outside its accessible filesystem. Restrict the runtime. For agents with shell access, use an isolated runtime with only required filesystem mounts. Do not inherit production credentials from the host environment. Check tool-specific exclusions. Repository ignore files govern repository behavior; do not assume they govern an assistant’s file access. Confirm whether documented exclusions cover direct reads, indexing, search and shell tools. Verify the boundary. Place a harmless marker in a prohibited test file and attempt access through each enabled route. If any route returns it, fix that route before introducing confidential material. An agent with shell access needs sandboxing and oversight when it can access the system. Hiding a file from an editor view does not establish that the agent’s runtime cannot read it. For example, an approved code copy can use synthetic fixtures while the original production export stays outside all mounted directories. These are general implementation steps, not universal editor settings. Remove sensitive content before prompts, indexing and training Sanitize data before it enters a prompt, document index or training dataset. Filtering the answer happens too late to prevent the model from accessing confidential input. Scan approved inputs. Review code, documentation, logs and connector content before ingestion. Look for recognizable secrets and organization-specific confidential material. Replace or remove sensitive content. Use synthetic records instead of customer exports. Redact restricted design details and proprietary content, not just credential patterns. Keep credentials outside model-visible results. Store operational credentials in a secrets manager. A tool can use an authorized credential without returning its value to the assistant. Sanitize retained copies. Apply checks to prompt traces, retrieved context and persisted summaries before they are stored or reused. Scrub data, vault secrets and monitor AI logs before connecting internal systems. Pattern-based detection can miss sensitive material, especially when confidentiality comes from business context rather than recognizable formatting. Add organization-specific rules and human review for that content. Review provider processing, retention, training and third-party-tool policies separately. A training opt-out concerns training use, not whether the service processes your request; self-hosting likewise does not stop your own model from receiving submitted data. Recheck the applicable controls when integrations change because platform interfaces and control mechanisms continue to evolve. Runtime permissions can block future retrieval, but fine-tuning requires dataset hygiene before training. Changing retrieval permissions afterward does not remove confidential material from trained weights. Enforce permissions on retrieval and tool execution Put access decisions in application code or an authorization service, outside the model. Treat a model-generated tool call as a proposed action, not permission to execute it. Use separate development identities. Give each workflow only the resources and operations it needs. Avoid supplying a developer’s broad production credentials. Allowlist tools and validate arguments. Permit narrow operations against approved resources. Prefer APIs returning approved fields over arbitrary SQL or unrestricted shell access. Authorize every execution. Look up the authenticated user’s permissions and check the proposed resource and operation before running the tool. Authorize retrieved content before context. Filter searches by the asking user’s permissions, then recheck access to each source document before adding its content to the prompt. Use a proposal-review-execute pattern: the model proposes a call, external logic reviews it, and execution happens only after approval. Do not infer the user’s authorization from model output. For retrieval-augmented generation, where retrieved documents are added to model context, an index filter is not the final authority. Check current document access against the source system before including a retrieved chunk. An older index entry may not reflect a later permission change. Read-only credentials still permit reading and potential disclosure. If a sensitive read requires human approval, obtain that approval before retrieval, not after the model receives the result. Apply the same external checks to database tools, APIs and tools exposed through MCP. Keep sessions, caches and derived data isolated Treat summaries, embeddings and cached tool results as potentially confidential records. Moving information out of the original document does not make it safe to share across users or environments. Attach boundary metadata. Key persisted state by the applicable tenant, user and environment. Write tenant metadata with embeddings and filter similarity searches by it. Enforce boundaries on reads and writes. Separate development from production stores, and avoid sharing agent contexts between users with different permissions. Manage derived copies. Give summaries, caches and indexes retention rules and deletion paths linked to the original records. Every derived store needs a retention period and a reachable deletion path. For example, a cached document summary must not become available to another user simply because it is shorter than the original. Check the requester’s permissions before loading it into context, and account for changed permissions when reusing stored results. A tenant-aware output check can catch some mistakes, but it is a backstop. It cannot replace authorization before the model receives another tenant’s content. Restrict network reachability without confusing it with data access Make development services reachable only by intended devices and identities, then enforce resource permissions separately. Network controls limit where an agent can connect; application controls determine what it may read or execute after connecting. Use firewall rules to restrict service access and outbound-destination controls to limit unnecessary connections. Test both permitted and denied paths. An allowed destination can still receive a sensitive payload, so destination filtering must accompany input sanitation and tool authorization. For private connectivity, doxx.net is a private network with firewalls, domain filtering, private domains, private PKI certificates, agent identity and authorized API/MCP tools for network management. Those documented capabilities support network configuration; you still need application-level checks for database rows, documents and application tools. If you need that connectivity, use the website’s Get Started and Download paths to create an account, download the app and connect a device or agent. Encryption protects transport, but it does not conceal a request from the receiving model service. Private connectivity does not prevent prompt injection or all data leakage. Keep the model’s proposed actions subject to external authorization even when the connection itself is private. Verify denied access with harmless test data Test the configured boundaries in an authorized environment using harmless, unique markers, never live credentials. Use a low-privilege account rather than the account that built the assistant, so broad development permissions do not hide failures. Prepare permitted and prohibited test resources. Put markers in test files, documents and caches with deliberately different access permissions. Exercise each enabled route. Test file reads, retrieval, tools, network connections and session state. Inspect the control decisions. Check retrieval results, execution decisions and sanitized request traces, not just the model’s answer. Correct failures and repeat. Suspend the affected integration, fix the boundary and rerun both denied and allowed tests. Test Expected evidence Corrective action Read an excluded file Runtime denial or file unavailable; marker absent from model input Fix workspace exposure, mounts or tool exclusions Retrieve another user’s document Authorization rejects it before context assembly Fix search filters and source-permission checks Invoke a denied tool External gate rejects execution Fix identity permissions and operation validation Connect to an unapproved endpoint Network control blocks the connection Correct destination restrictions Read another session’s cache Cache access denied; marker absent from context Fix session keys and read authorization Use an approved file or tool Authorized content arrives or operation succeeds Repair the integration if the allowed path also fails A refusal such as “I cannot reveal that” does not prove the model lacked access. Prompt restrictions can be bypassed, so inspect whether prohibited content entered context at all. Passing these tests supports the boundaries tested; it is not a guarantee against every leak or attack. If confidential data has already reached the model Stop the affected workflow and treat the submission as a disclosure requiring review. Changing a prompt or permission can prevent future access, but it cannot undo what the model already received. Contain access. Suspend the affected connector, tool or workflow. Notify the responsible security team or data owner through your authorized incident process. Revoke or rotate exposed credentials. If a usable credential was submitted, address that credential rather than relying on conversation deletion. Trace retained copies. Review conversations, logs, caches, indexes and downstream services. A secret exposed in logged processing steps can create multiple leaked copies. Use available deletion mechanisms. Check their documented scope and address derived stores through their deletion paths. Do not assume deleting a conversation removes provider records, downstream copies or trained model content. Preserve the incident information your authorized process requires without spreading the confidential payload into new tickets or logs. Record which boundaries failed, which copies were addressed and which deletion limits remain. If confidential material entered fine-tuning data, runtime authorization is not a removal mechanism. Address the affected dataset and model through the responsible owner’s procedures; dataset hygiene belongs before training, not after deployment. On this page Define what the assistant must never receive Give the assistant a sanitized development workspace Remove sensitive content before prompts, indexing and training Enforce permissions on retrieval and tool execution Keep sessions, caches and derived data isolated Restrict network reachability without confusing it with data access Verify denied access with harmless test data If confidential data has already reached the model Author doxx.net Editorial Category engineering Published 6 Oct 2026 Reading time 10 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 engineering Specify an SSH Port When Connecting Use ssh -p to connect on a specific port. Learn how to save the port in SSH config, select ports in scp and sftp, and check failed connections. doxx.net Editorial 6 min read 6 Oct 2026 security Blocking Encrypted DNS Traffic: What It Means and What to Check Learn what an encrypted DNS warning means, how blocking affects privacy, and how to check device settings, network controls and DNS fallback. doxx.net Editorial 6 min read 6 Oct 2026 privacy Can website owners see who visits? Website owners can see visit data, but usually not your name. Learn how logins, cookies, and identity matches affect privacy and what you can limit. doxx.net Editorial 9 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## RDP Port: Default 3389, TCP, UDP and Gateway Ports URL: https://www.doxx.net/insight/rdp-port/ Product Resources Pricing Get Started Insights RDP Port: Default, Custom Listener and Gateway Ports RDP defaults to TCP 3389 and can also use UDP 3389. Learn gateway ports, how to check the listener, and how to change it with recovery steps. On this page TCP is the baseline; UDP supports responsiveness Gateway ports are different from the host's listening port Check the configured port and the active listener Changing the port requires a matching firewall rule Keep RDP reachable through a private access path RDP uses TCP port 3389 by default. Modern RDP can also use UDP port 3389 for improved responsiveness. A custom listener can use a different port, while connections through RD Gateway typically reach the gateway on TCP 443, with UDP 3391 available for its UDP transport. TCP is the baseline; UDP supports responsiveness For a direct connection, the relevant port is the destination port on the RDP host. It is not the client's source port, and the default does not mean every Windows computer automatically has an active RDP listener. Direct RDP transport Default destination port Role TCP 3389 Baseline connection to the RDP host UDP 3389 Optional modern RDP transport that supports responsiveness when enabled and permitted Start troubleshooting a direct connection by checking TCP reachability to the host's configured port. If UDP is blocked, an RDP session may still work over TCP, so a failed UDP check does not by itself explain a complete connection failure. Allow the intended transport only from approved access paths and source addresses. If TCP is reachable but the session still fails, investigate RDP configuration, authentication and authorization rather than assuming that another port must be opened. Gateway ports are different from the host's listening port The connection path determines which destination your client must reach. A direct client contacts the host's RDP listener; a gateway client contacts RD Gateway, which then connects to the internal host on that host's configured RDP port. Connection path Client destination Host-side listener Direct, default listener RDP host on TCP 3389; UDP 3389 when enabled Default RDP listener on 3389 Direct, custom listener RDP host on the administrator-configured port Configured RDP port RD Gateway over HTTPS Gateway on TCP 443 Internal host's configured RDP port RD Gateway UDP transport Gateway on UDP 3391 Internal host's configured RDP listener For a custom direct listener, specify the destination as hostname:port. The client must use the new port, and the firewall must permit it; allowing only the default port will not reach a listener configured elsewhere. With RD Gateway, check both network segments: client to gateway, and gateway to internal host. A successful connection to TCP 443 does not prove that the gateway can reach the desktop. Likewise, UDP 3391 is the gateway's UDP path, not a replacement default listener on every Windows desktop. Build firewall permissions around the path you actually use. Keep gateway-facing permissions separate from internal host permissions, and do not expand a generic RDP allowlist with unrelated service ports. Check the configured port and the active listener On a Windows RDP host you are authorized to administer, inspect configuration first and runtime state second. These checks are read-only: they do not change the listening port, restart the host or modify firewall permissions. Inspect the configured port. Open Registry Editor and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp. Inspect PortNumber, display its value using Decimal, and record it without editing or saving a change. Cancel the value dialog when finished. Inspect current endpoints. Run netstat -a -n -o in a Windows terminal. Find the TCP local endpoint whose port matches the recorded value and check whether it is marked LISTENING. Identify the owning process and service. Use the PID shown by netstat to find the process in Task Manager and inspect its associated services. This endpoint-to-process check helps distinguish the intended listener from another process using the port. Compare the results with the client's path. Confirm whether the client connects directly to this host or through RD Gateway. The gateway's external port and the host's internal listener serve different parts of the connection. The registry value proves the configured port, not that the service is currently listening. A matching listener proves local availability, not remote reachability, successful authentication, authorization or certificate validation. If the configured port and active listener differ, check whether Remote Desktop is enabled and whether a restart is pending after an earlier change. If the listener matches but the client cannot connect, check the route and applicable firewall permissions. These read-only checks need no rollback, and an absent listener is not a reason to open more firewall ports. Changing the port requires a matching firewall rule Changing the listening port is an optional administration task, not a prerequisite for using RDP privately. Windows permits changing the RDP listening port through the registry, but the listener, firewall permissions and client destination must remain aligned. Proceed only with authorization, a registry backup and a maintenance window. Have console or out-of-band recovery access before changing anything, because an incorrect port or rule can remove your remote access. Record the original configuration. Save the current decimal PortNumber value and relevant firewall settings. Choose an unused port and check current listeners before assigning it. Prepare narrowly scoped permissions first. Configure the firewall before changing the RDP port. Permit the new listener port through the host firewall and any intervening network firewall, restricting access to approved private sources. Include UDP only where that transport is intended and enabled. Change the listener value. In Registry Editor, open PortNumber at the path above, select Decimal, and enter the chosen port. Keep the recorded original value and backup available for recovery. Restart and reconnect. Restart the host during the maintenance window, then connect using hostname:port. Check the active listener again if the destination does not respond. Validate before removing old permissions. Confirm that an authorized session succeeds through the intended private path. Then remove obsolete permissions, including old rules for port 3389 if they are no longer needed. If the new connection fails, use recovery access to restore the original registry value and firewall rules, then restart again. Do not keep broadening access rules to compensate for an unconfirmed listener change. A nonstandard port can reduce routine scanning noise, but it remains discoverable and attackable when exposed publicly. Treat renumbering as a configuration choice, not a substitute for restricting access. Keep RDP reachable through a private access path Use an authorized private network path or a properly administered RD Gateway instead of exposing the host's RDP listener directly to the public internet. Publishing TCP 3389 publicly is a high-risk choice, and moving the listener to another port does not remove that exposure. For a default direct connection, the network requirement is a route to TCP 3389 on the target. A routed private connection does not require public per-host port forwarding. When devices are on separate networks, provide an appropriate access path; that requirement follows the network layout, not the client's Windows version. Keep network reachability, host firewall permission and RDP authentication separate when diagnosing failures. A working route cannot override a host firewall restriction, and an open TCP port cannot prove that an account may sign in. Keep the host patched, use Network Level Authentication and restrict access to approved accounts. If you need a private device connection, doxx.net is a private network with firewall controls. Create an account through the website's Get Started path, use Download to get the app, and connect your devices. Configure Windows RDP, host firewall scope and account permissions separately; the private network is an access path, not an RDP server, RD Gateway or replacement for endpoint security. On this page TCP is the baseline; UDP supports responsiveness Gateway ports are different from the host's listening port Check the configured port and the active listener Changing the port requires a matching firewall rule Keep RDP reachable through a private access path Author doxx.net Editorial Category Networking Published 6 Oct 2026 Reading time 06 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 Networking Can You Access Your NAS From Anywhere? Yes, you can access your NAS from outside your home network once you configure remote access. doxx.net Editorial 11 min read 6 Oct 2026 Networking How to Change Your Wi-Fi Channel Change your router’s Wi-Fi channel, choose settings for each band, test performance, and learn what to do if channel controls are locked. doxx.net Editorial 6 min read 6 Oct 2026 Networking How to Find the IP Address of a Printer Find your printer's IP address using its display, a network report, Windows or Mac settings, or your router. Confirm the address before printing. doxx.net Editorial 10 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Secure Internal Communication: Best Practices URL: https://www.doxx.net/insight/secure-internal-communication/ Product Resources Pricing Get Started Insights Secure Internal Communication: Protect Messages, Calls, Files, and Services Learn how to secure internal messages, calls, files, and services with encryption, access controls, device protection, policies, and practical checks. On this page What you need to protect Identify how internal information can escape Match each protection to the risk it addresses Put a workable communication policy into practice Add a private network for internal services when needed Resolve privacy, retention, and oversight requirements Check that your controls work Secure internal communication means protecting information exchanged within your organization so that intended participants can access it, unauthorized parties cannot readily read or change it, and teams can keep working. It covers chat, email, voice and video calls, file sharing, and collaboration tools. Build it with approved communication channels, appropriate encryption, strong authentication, least-privilege access, protected devices, clear sharing and retention rules, and regular checks. Encryption alone is not enough. What you need to protect Protect the information, its accuracy, and your team's ability to use it. These goals are called confidentiality, integrity, and availability. They apply throughout a conversation's life, including shared attachments and retained records. Consider a team sharing a confidential project plan. Confidentiality means only the intended audience should be able to read it. Integrity means protecting the plan against unauthorized changes, so a substituted attachment or altered instruction does not silently become the team's working version. Availability means authorized colleagues can retrieve the plan when they need it, including through an approved recovery process. “Internal” describes the intended organizational audience, not everyone connected to the office network. A remote employee may belong in the discussion, while a visitor on the office network may not. An invited contractor may need one project channel without needing access to other confidential work. The practical foundation is governance, culture, and tools working together. A protected channel still needs clear membership, responsible sharing, and people who know how to report suspicious requests. Identify how internal information can escape Start with compromised identities, incorrect permissions or recipients, exposed channels, and compromised devices. Misrouted messages, unauthorized access, compromised credentials, and insecure channels can expose information or disrupt work. Grouping risks this way helps you choose controls that address the actual failure. A contractor left in a project channel has access that may no longer be justified, even if every message is encrypted. Review channel membership when assignments end, not just when accounts are created. Similarly, checking recipients and link permissions before sharing a confidential plan addresses accidental disclosure that encryption cannot correct. A fake executive request targets your judgment or identity controls rather than the encryption. An internal-looking sender name is not proof that the request is authorized. Confirm unusual requests for sensitive files or access through a known, separate channel. Device compromise creates another route to content after it reaches a legitimate participant. Office-network access does not establish that a device is trustworthy or its user is entitled to a particular conversation. Protect devices and keep communication software current, because missed updates can leave known vulnerabilities open. Match each protection to the risk it addresses Each control protects a particular boundary. Choose it for that boundary rather than treating “encrypted” or “private” as a complete security description. Protection Protected boundary Remaining exposure Transport encryption, such as TLS Protects traffic along a connection between its endpoints. An endpoint that terminates the connection may access plaintext. This does not automatically provide application end-to-end encryption. Application end-to-end encryption Protects content between participating endpoints without giving intermediaries content-decryption access. Authorized recipients, compromised endpoints, screenshots, and recordings can still expose content. Storage encryption Protects stored data under its encryption and key-access model. A running application or user with decryption access may still read the content. Authentication Establishes the identity of a user or device. A valid identity does not establish permission to access every channel or file. Authorization and least privilege Determines what an authenticated identity may access or change. Excessive permissions and outdated membership can still expose information. Network segmentation Limits reachability between network areas or services. Reachability restrictions do not replace application authentication, permissions, or encryption. For the project plan, TLS may protect your connection to a communication service while leaving that service able to process the content. With application end-to-end encryption, content is encrypted at the sender and decrypted at the intended recipient. Check which participants and features use that model rather than assuming it applies to every conversation, attachment, or integration. Permissions answer a separate question: who should receive the plan at all? Apply least privilege by giving people only the access they need, and use network segmentation to limit access to sensitive areas where appropriate. Neither control prevents an authorized recipient from copying content. Put a workable communication policy into practice Approved tools, authentication, least privilege, device protection, and training form the baseline. Add retention, export, and audit requirements where your organization's obligations require communication records. Make each policy decision produce something your team can use and review. Inventory tools and data flows. Identify approved and unapproved tools and map the data moving through them. Include messages, calls, files, guest access, and integrations. Deliverable: a channel-and-data map with an owner for each service. Classify information and identify obligations. Distinguish routine collaboration from confidential project plans and other sensitive material. Identify organizational recordkeeping and access requirements. Deliverable: a handling guide describing where each information category may be shared and retained. Select approved channels. Check encryption boundaries, identity controls, guest handling, and recovery options against the intended use. Explain which channels are approved and why. Deliverable: a usable channel guide, including alternatives for work currently happening in personal apps. Enable strong authentication and least privilege. Use multifactor authentication, which requires more than a password, where supported. Assign access according to work responsibilities and review it after role changes and departures. Deliverable: reviewed permissions and an account-change procedure. Separate guest collaboration from confidential discussions. Give contractors and other guests access to the material they need without automatically including them in unrelated conversations. Deliverable: a reviewed guest-membership list and clear sharing boundaries. Protect and update devices. Use appropriate device encryption, endpoint management, timely updates, and remote-wipe capabilities for devices accessing sensitive data. Deliverable: a device-protection baseline and a process for handling exceptions or lost devices. Assign review and incident owners. Name who reviews access, handles suspicious messages, and coordinates recovery. Explain reporting and sharing rules to users rather than merely prohibiting tools. Deliverable: an access-review schedule and an incident-reporting path people can find. Add a private network for internal services when needed Communication-platform controls are the starting point. Add private network reachability when your team operates a self-hosted chat service, file service, or another internal application that should not be publicly reachable. Restrict access to the devices that need it while retaining application authentication, authorization, and encryption. For example, a private file service may need to be reachable by project devices but not by unrelated devices. That network boundary reduces exposure; it does not decide which files each authenticated user may open. Keep remote administration off the public internet and maintain a protected administrative access path. Self-hosting gives you infrastructure control, but managed hosting may be more practical when your team cannot reliably maintain the service and its security updates. Choose based on your capacity to operate the system securely, not on the assumption that owning the server makes its communications safe. For private communication and service connectivity, doxx.net is a private network with P2P end-to-end encrypted chat, voice and video calls, device-to-device file transfer, firewalls, private domains, and private PKI certificates. Those capabilities do not by themselves establish enterprise identity management, archiving, data loss prevention, or compliance suitability. If this matches your need, use the website's Get Started and Download paths to create a doxx.net account, download the app, and connect a device. Resolve privacy, retention, and oversight requirements Minimizing retained sensitive content reduces exposure; controlled retention is necessary when legal, operational, or investigation requirements justify keeping records. Set retention by information category and purpose rather than keeping everything indefinitely or deleting everything automatically. Your policy should balance recordkeeping requirements with protection of current and historical communications. For the confidential project plan, decide whether the authoritative document needs to be retained separately from the surrounding discussion. Some organizations also need controlled exports or audit trails to demonstrate that communication protocols were followed. Limit archive access to authorized roles and disclose monitoring practices to participants. Access and administrative metadata are different from message-content inspection. A record showing that an account joined a channel does not necessarily reveal what participants said. Before enabling an archive, bot, integration, or authorized export, determine how it receives plaintext and whether that fits your intended end-to-end encryption model. An archive acting as an authorized recipient creates another place where readable content may be available. Protect its access and retention accordingly rather than assuming the original encryption protects every downstream copy. Security features support an assessment of your obligations; selecting a tool or private network does not automatically establish legal compliance. Check that your controls work Use authorized test accounts and non-sensitive files to check the boundaries you intended to create. Each check should record the expected result, what the result establishes, and the action to take if it differs. Try a restricted channel from an out-of-scope account. Expect access to be denied. This validates that account's tested permission boundary, not every route into the content. If access succeeds, review membership, inherited permissions, and sharing links, then repeat the check. Test departure handling. Apply your departure procedure to a designated test account, then attempt access through an existing session and a fresh sign-in. Expect both to fail where access was revoked. If either works, inspect group membership, sessions, tokens, and guest links before retesting. Try a private service from an unauthorized device. Expect the service to be unreachable through the tested path. This checks that network boundary, not application permissions or every possible route. If it remains reachable, review network rules and alternative exposure paths, then test again. Exercise an approved recovery procedure. Expect an authorized participant to regain access without granting unintended permissions or bypassing identity checks. This tests recovery as well as availability. If it fails, correct the procedure and repeat it using non-sensitive material. Check the encryption model separately. Successful message delivery proves delivery, not end-to-end encryption. Inspect the documented mode, participant coverage, and key-handling behavior against your requirements. If coverage differs, adjust the channel, feature, or participant arrangement before sharing sensitive content. Review these checks when permissions, integrations, or network rules change, and keep software updates and incident procedures under regular review. Run incident-response drills so employees can act promptly, then address unclear responsibilities or failed reporting paths uncovered by the exercise. On this page What you need to protect Identify how internal information can escape Match each protection to the risk it addresses Put a workable communication policy into practice Add a private network for internal services when needed Resolve privacy, retention, and oversight requirements Check that your controls work Author doxx.net Editorial Category security Published 6 Oct 2026 Reading time 09 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 security Blocking Encrypted DNS Traffic: What It Means and What to Check Learn what an encrypted DNS warning means, how blocking affects privacy, and how to check device settings, network controls and DNS fallback. doxx.net Editorial 6 min read 6 Oct 2026 security AI Browser Agent Security: Current Risks and Practical Controls AI browser agents remain vulnerable to prompt injection. Learn how scoped access, execution controls, approvals and recovery tests limit exposure. doxx.net Editorial 9 min read 6 Oct 2026 security EAP methods for Wi-Fi: what they mean and which to choose Understand EAP-TLS, PEAP and EAP-TTLS, match your enterprise Wi-Fi profile, validate server certificates and troubleshoot authentication failures. doxx.net Editorial 10 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## How to Specify an SSH Port When Connecting URL: https://www.doxx.net/insight/ssh-specify-port/ Product Resources Pricing Get Started Insights Specify an SSH Port When Connecting Use ssh -p to connect on a specific port. Learn how to save the port in SSH config, select ports in scp and sftp, and check failed connections. On this page Use the server's connection details Save the port for repeat connections Choose the correct option in other clients Check a failed connection without guessing Keep remote administration on an authorized private path Use lowercase -p followed by the port number: ssh -p 2222 user@server.example.com. Replace the example port, username and hostname with the server's actual connection details. ssh -p 2222 user@server.example.com SSH uses port 22 by default. Specifying a different port changes the client's destination port, not the server's listening port. Use the server's connection details The right port is the one the server accepts for your authorized connection. Choosing an arbitrary alternate port will not move the SSH service there. Obtain the connection details. Get the hostname or IP address, your authorized username and the configured SSH port from the administrator. Use the administrator-provided port when the server accepts SSH on a port other than the default. Open a terminal with OpenSSH available. The command applies to the OpenSSH client on Linux, macOS and Windows. Connect only to a system you are authorized to access. Run the command with your actual details. ssh -p 2222 user@server.example.com Here, 2222 is the destination port, user is the remote account and server.example.com is the destination hostname. Keep the option lowercase and place it before the destination. Check the outcome. A successful login establishes that SSH was reachable and authentication succeeded using those details. If the connection fails, use the troubleshooting steps below rather than changing the server blindly. This command makes no server configuration change, so there is no server-side change to undo. To try corrected connection details, run the command again with the corrected values. Save the port for repeat connections A saved host entry lets you reuse the hostname, port and username through a short alias. An explicit command-line port overrides the configured port, so you can still choose a different destination port for an individual connection. Locate your client configuration and back it up. On Linux and macOS, use ~/.ssh/config. For Windows OpenSSH, use the .ssh/config file under your Windows user profile. If the file already exists, make a backup before editing it and preserve unrelated settings. Add or update a unique host-specific entry. Place it before matching general defaults such as Host *, not unconditionally at the end of the file. Host myserver HostName server.example.com Port 2222 User user myserver is the alias you will type; HostName is the actual destination. Replace the example values with the details you are authorized to use. Inspect the effective configuration before connecting. ssh -G myserver Check the effective HostName, Port and User values in the output. This command evaluates configuration without opening a remote connection. Connect through the alias. ssh myserver If the effective values match the intended destination, this uses the saved connection details. A successful login, rather than configuration inspection alone, confirms that the destination is reachable and your authentication works. OpenSSH normally uses the first obtained value for each configuration parameter. A later duplicate entry does not override an earlier matching value, so if ssh -G myserver shows unexpected details, review earlier matching entries and correct the relevant setting. To reverse the edit, restore the backup if no subsequent changes need preserving. Otherwise, remove only the new stanza or undo the specific changes you made, leaving unrelated configuration intact. Choose the correct option in other clients Port-selection syntax differs between clients: OpenSSH ssh uses lowercase -p, while scp and sftp use uppercase -P. Use these terminal commands where the corresponding OpenSSH tools are installed; PuTTY on Windows uses a graphical field instead. Client Port selection Example or setting OpenSSH ssh Lowercase -p ssh -p 2222 user@server.example.com OpenSSH scp Uppercase -P scp -P 2222 file.zip user@server.example.com:/home/user/ OpenSSH sftp Uppercase -P sftp -P 2222 user@server.example.com PuTTY on Windows Session screen's Port field Enter the hostname, set Port to 2222 and retain SSH as the connection type. The SCP example uploads the local file.zip to /home/user/ on the remote system. It requires authorized write access to that destination and may overwrite a file with the same name. Use a disposable example file and a destination you control; back up an existing remote file before replacing it. To reverse a test upload, remove only the test file you created in the controlled destination. Removing the uploaded file does not recover an overwritten original, which requires its backup. The SFTP command opens a file-transfer session using the selected port; it does not upload a file by itself. For both transfer tools, use the SSH endpoint details supplied for your access rather than assuming the example port applies to the server. Check a failed connection without guessing Client port selection is sufficient when the SSH service and authorized network path already support that port. When they do not, investigation must move beyond the client command, but the error message alone does not identify the cause. Check the effective client destination. Review the hostname, username and -p value in your command. If you use a saved alias, run ssh -G myserver and inspect the effective destination, port and user without connecting. Remember that an explicit command-line -p takes precedence over the saved port. Confirm the actual listening port. Ask the administrator which SSH port is available for your connection and whether the hostname or address is correct. A port that worked previously may no longer match the current service or access arrangement. Selecting -p does not configure sshd, open a firewall or establish port forwarding. Separate connection errors from authentication errors. “Connection refused” records an observed rejection of the connection attempt; it does not uniquely prove that no service is listening. A timeout means the connection did not complete in time, not that a firewall necessarily blocked it. An authentication rejection is a different stage and calls for checking your authorized username, credentials and account access. Investigate the authorized network path. For timeouts, check the network and destination address, then ask the administrator to review the applicable access rules. Confirm whether the destination requires a private route or another approved access path. Do not treat opening public access as the default fix. Keep recovery access during an administrator-led change. If the administrator recently changed the listening port, retain the working session until the new setup is confirmed. Keep recovery access available as well, and verify a separate connection succeeds before closing the working session. Correct client values establish what you are attempting to reach, not that the service is available. If those values are right but the connection still fails, give the administrator the destination, selected port and exact observed error so they can investigate the service and access path. Keep remote administration on an authorized private path A nondefault port is not an access-control boundary and does not make SSH undiscoverable. Changing the port does not, by itself, secure SSH, so do not treat it as a substitute for authentication or restricted access. Use the chosen port on an authorized private route when one is available. Restrict administration access rather than opening it to the whole internet. The useful distinction is who can reach the service and authenticate, not merely whether its port differs from the default. Keep destination-port selection separate from forwarding. -p selects the port used to reach the SSH server; -L, -R and -D request forwarding, with -D providing dynamic application-level port forwarding. You do not need a forwarding option simply because the server accepts SSH on a different port. On this page Use the server's connection details Save the port for repeat connections Choose the correct option in other clients Check a failed connection without guessing Keep remote administration on an authorized private path Author doxx.net Editorial Category engineering Published 6 Oct 2026 Reading time 06 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 engineering How to Prevent an LLM from Accessing Confidential Development Data Keep confidential data out of LLM context with isolated workspaces, sanitized inputs, retrieval authorization, tool permissions and boundary tests. doxx.net Editorial 10 min read 6 Oct 2026 security Blocking Encrypted DNS Traffic: What It Means and What to Check Learn what an encrypted DNS warning means, how blocking affects privacy, and how to check device settings, network controls and DNS fallback. doxx.net Editorial 6 min read 6 Oct 2026 privacy Can website owners see who visits? Website owners can see visit data, but usually not your name. Learn how logins, cookies, and identity matches affect privacy and what you can limit. doxx.net Editorial 9 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Subnet Cheat Sheet: IPv4 Masks and Host Counts URL: https://www.doxx.net/insight/subnet-cheat-sheet/ Product Resources Pricing Get Started Insights Subnet Cheat Sheet: IPv4 Masks, Host Counts and Boundaries Look up IPv4 subnet masks, usable hosts and wildcard masks. Calculate subnet boundaries, size address blocks and compare IPv6 prefix capacities. On this page IPv4 prefixes, masks and host counts Find the network, host range and broadcast Quick boundaries when splitting a /24 Size a private subnet for devices and services IPv6 prefix sizes at a glance When the usable-host shortcut does not apply An IPv4 subnet cheat sheet maps a CIDR prefix to its subnet mask and address capacity. Common entries are /24 = 255.255.255.0 with 256 total addresses and 254 usable hosts, /26 = 255.255.255.192 with 64 total and 62 usable, and /30 = 255.255.255.252 with 4 total and 2 usable. A /31 has two usable addresses on a supported point-to-point link; a /32 identifies one address. IPv4 prefixes, masks and host counts CIDR Subnet mask Total addresses Usable hosts Wildcard mask /32 255.255.255.255 1 1, single address or host route 0.0.0.0 /31 255.255.255.254 2 2, supported point-to-point link 0.0.0.1 /30 255.255.255.252 4 2 0.0.0.3 /29 255.255.255.248 8 6 0.0.0.7 /28 255.255.255.240 16 14 0.0.0.15 /27 255.255.255.224 32 30 0.0.0.31 /26 255.255.255.192 64 62 0.0.0.63 /25 255.255.255.128 128 126 0.0.0.127 /24 255.255.255.0 256 254 0.0.0.255 /23 255.255.254.0 512 510 0.0.1.255 /22 255.255.252.0 1,024 1,022 0.0.3.255 /21 255.255.248.0 2,048 2,046 0.0.7.255 /20 255.255.240.0 4,096 4,094 0.0.15.255 /19 255.255.224.0 8,192 8,190 0.0.31.255 /18 255.255.192.0 16,384 16,382 0.0.63.255 /17 255.255.128.0 32,768 32,766 0.0.127.255 /16 255.255.0.0 65,536 65,534 0.0.255.255 CIDR notation gives the number of network-prefix bits after the slash. The subnet mask expresses that same boundary in dotted-decimal form, while the wildcard mask is its inverse: subtract each mask octet from 255. A longer prefix leaves fewer host bits, so it describes a smaller address block. Use total addresses to understand the block’s size and usable hosts to estimate ordinary interface capacity. For ordinary broadcast subnets, the network and broadcast addresses account for the difference between those columns. The qualifications beside /31 and /32 matter: their counts do not follow the ordinary subtraction rule. Find the network, host range and broadcast Find the subnet containing an address by locating the boundary at or below that address, then finding the last address before the next boundary. For 192.168.1.130/26, the result is network 192.168.1.128, ordinary hosts 192.168.1.129 through 192.168.1.190, and broadcast 192.168.1.191. Translate the prefix into a mask. A /26 uses 255.255.255.192. Its changing octet is the last octet, where the mask value is 192. Calculate the increment in that octet. The increment equals 256 minus the mask value, so 256 - 192 = 64. Subnet boundaries therefore occur at last-octet values .0, .64, .128 and .192. Find the containing boundary. The address’s last octet, 130, lies between 128 and the next boundary, 192. Keep the common prefix and use the lower boundary: 192.168.1.128. Find the broadcast address. Take the address immediately before the next subnet, 192.168.1.192. That gives 192.168.1.191, matching the /26 boundary and host-range pattern. Remove the ordinary reserved endpoints. The first host follows the network address, and the last host precedes the broadcast address. Here, the ordinary usable range is 192.168.1.129 through 192.168.1.190. The increment belongs to the changing octet, so it is not always the total address count. With /23, the mask is 255.255.254.0: the increment is 2 in the third octet, but the block contains 512 addresses. Set any trailing host octets to .0 for the network boundary and .255 for the broadcast boundary. This calculation establishes address membership, not connectivity. Matching subnet arithmetic does not establish that routes, firewalls or interfaces are configured correctly. If a calculator gives a different result, check the entered prefix and the octet used for the increment before changing configuration. Quick boundaries when splitting a /24 Within a single /24, prefixes from /25 through /30 advance in the last octet. Each longer child prefix produces smaller blocks and more child subnets within that same parent. Child prefix Last-octet increment Child subnets within one /24 Ordinary usable hosts per child /25 128 2 126 /26 64 4 62 /27 32 8 30 /28 16 16 14 /29 8 32 6 /30 4 64 2 The subnet counts and boundary patterns are relative to the parent block. “Four /26 subnets” means four inside a /24, not four inside every possible parent network. A larger parent can contain more children of the same prefix. For the parent 192.168.1.0/24, all addresses below share the first three octets, 192.168.1. Its complete /26 split is: Network First ordinary host Last ordinary host Broadcast 192.168.1.0/26 192.168.1.1 192.168.1.62 192.168.1.63 192.168.1.64/26 192.168.1.65 192.168.1.126 192.168.1.127 192.168.1.128/26 192.168.1.129 192.168.1.190 192.168.1.191 192.168.1.192/26 192.168.1.193 192.168.1.254 192.168.1.255 Read each row as one complete block: network first, ordinary hosts in the middle, broadcast last. To check a boundary table, confirm that each broadcast immediately precedes the next network and that each ordinary host range excludes both endpoints. This makes a misplaced host-range endpoint easier to catch before you use the table for address assignments. Size a private subnet for devices and services Choose the smallest ordinary subnet whose usable-host capacity covers your complete address budget, including infrastructure and deliberate growth room. Count addresses you intend to assign, not just the devices you can see today. List the planned assignments. Include personal devices, self-hosted services and any other interfaces that need addresses on this subnet. Count each required address rather than assuming every device needs only one. Include network infrastructure. Add the gateway and any management or service addresses that belong in the same subnet. These consume usable addresses even when they are not part of a dynamic assignment pool. Allow deliberate growth room. Include expected additions in the budget before selecting a prefix. This keeps the capacity decision tied to your plan rather than to a familiar mask. Compare the budget with the usable-host column. Choose the smallest subnet that meets the segment’s needs, then select an aligned network boundary. Confirm that your proposed assignments stay within its ordinary host range. For example, a complete budget of 30 addresses fits a /27, which has 30 ordinary usable addresses. A /28 provides only 14 and would be too small. If your budget grows beyond 30, a /26 provides 62 ordinary usable addresses. These private IPv4 blocks provide address space from which you can plan smaller subnets: Private block Subnet mask Address range 10.0.0.0/8 255.0.0.0 10.0.0.0 through 10.255.255.255 172.16.0.0/12 255.240.0.0 172.16.0.0 through 172.31.255.255 192.168.0.0/16 255.255.0.0 192.168.0.0 through 192.168.255.255 Private addressing is an address-planning choice, not encryption or access control. Plan those protections separately, and do not treat a private address as proof that a service is isolated. Likewise, the usable-host count is not automatically your DHCP pool size: static assignments, configured exclusions and platform reservations can leave fewer addresses available for dynamic allocation. IPv6 prefix sizes at a glance IPv6 uses 128-bit addresses and prefix notation, but its quick reference is best read separately from IPv4 host counts. For larger allocations, the useful comparison here is how many /64 subnets fit inside the block. IPv6 prefix Reference capacity /48 65,536 /64 subnets /56 256 /64 subnets /60 16 /64 subnets /64 1 /64 subnet /127 2 total addresses /128 1 total address The /64 subdivision counts describe parent-and-child relationships, not mandatory allocation sizes. A /56 contains 256 /64 subnets, while a /60 contains 16. Read the /127 and /128 rows differently: they show total addresses, not counts of /64 subnets. Do not carry the ordinary IPv4 network-and-broadcast subtraction into IPv6. The table gives address-space capacity, not a guarantee that every prefix is suitable for every link or deployment. Use the allocation and link requirements of your network rather than treating /48, /56 or /64 as universal requirements. When the usable-host shortcut does not apply For ordinary IPv4 broadcast subnets, total addresses = 2^(32 - prefix), and ordinary usable hosts = total addresses minus two. The subtraction accounts for the network and broadcast addresses. A /26 therefore has 64 total addresses and 62 ordinary usable hosts, as shown in the IPv4 capacity table. A supported /31 point-to-point link uses both addresses, so subtracting two would give the wrong result. A /32 represents one address, including single-address or host-route use. Choose the counting rule for the prefix and link type rather than applying the ordinary shortcut mechanically. An address written with a prefix is not necessarily the normalized network address. In 192.168.1.130/26, the address is inside the subnet, while 192.168.1.128/26 names its network boundary. Similarly, an address ending in .0 or .255 is not automatically unusable: in a larger block, either can fall inside the host range rather than at the complete subnet’s endpoints. Configured pools and platform reservations can reduce what you can actually assign without changing the subnet’s mathematical capacity. Keep the block’s total addresses, its ordinary usable range and your configured assignment pool distinct. If the available pool is smaller than expected, inspect its boundaries, exclusions and reserved assignments before changing the subnet size. On this page IPv4 prefixes, masks and host counts Find the network, host range and broadcast Quick boundaries when splitting a /24 Size a private subnet for devices and services IPv6 prefix sizes at a glance When the usable-host shortcut does not apply Author doxx.net Editorial Category Networking Published 6 Oct 2026 Reading time 09 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 Networking Can You Access Your NAS From Anywhere? Yes, you can access your NAS from outside your home network once you configure remote access. doxx.net Editorial 11 min read 6 Oct 2026 Networking How to Change Your Wi-Fi Channel Change your router’s Wi-Fi channel, choose settings for each band, test performance, and learn what to do if channel controls are locked. doxx.net Editorial 6 min read 6 Oct 2026 Networking How to Find the IP Address of a Printer Find your printer's IP address using its display, a network report, Windows or Mac settings, or your router. Confirm the address before printing. doxx.net Editorial 10 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Fix “This Site Can’t Provide a Secure Connection” URL: https://www.doxx.net/insight/this-site-can-t-provide-a-secure-connection-fix/ Product Resources Pricing Get Started Insights How to Fix “This Site Can’t Provide a Secure Connection” Check the error code, compare browsers and networks, and troubleshoot clock, browser, or HTTPS settings without bypassing certificate warnings. On this page Start with these checks before changing settings Read the code beneath the warning Find out whether the failure follows the site or your setup Repair browser and device problems one change at a time Test the network without bypassing HTTPS protection If you own the site, check the HTTPS configuration Know when to stop and report the error To fix “This site can’t provide a secure connection,” reload once, note the exact error code, and test the same URL in another browser and on another device or trusted network. If the failure is local, check your device’s clock, update your browser, and investigate site data, extensions, or connection settings one change at a time. If the same website fails across browsers, devices, and networks, contact the site owner rather than bypassing the warning. The headline message alone does not establish the cause. Start with these checks before changing settings Keep the URL identical during comparisons. These checks narrow the scope; they do not repair every possible cause. Verify the address. Confirm that you entered the intended hostname and HTTPS address, especially if you followed a link. Reload once. If the error remains, stop repeatedly refreshing and inspect the warning. Record the exact code. Use the next section to interpret it, rather than treating every secure-connection warning alike. Try another browser. If only the original browser fails, follow the browser and device repair steps below. Try another device or trusted network. If the failure follows the network, use the network checks; if one site fails across independent setups, use the owner or reporting branch. Also check whether other HTTPS sites load. A failure affecting one domain calls for a different investigation from a failure affecting many sites. Read the code beneath the warning The code identifies an observed failure, but it may leave several causes open. Match it to the next check rather than applying every suggested fix. Code Observed failure Next check ERR_SSL_PROTOCOL_ERROR Generic SSL/TLS protocol failure, not necessarily limited to the handshake. Compare browsers, devices, and networks to narrow the scope. ERR_SSL_VERSION_OR_CIPHER_MISMATCH Incompatible protocol or cipher parameters. Update the browser; the owner should check supported TLS settings. ERR_CERT_DATE_INVALID Certificate validity-date check failed. Check the device clock and certificate validity dates. ERR_CERT_COMMON_NAME_INVALID The certificate does not cover the requested hostname. Verify the address; the owner should check hostname coverage. ERR_CERT_AUTHORITY_INVALID The certificate’s issuing authority is not trusted. Investigate the certificate chain and the client’s trust configuration. ERR_CONNECTION_CLOSED The connection closed. The code alone identifies neither who closed it nor when. Compare environments before assigning a cause. A date error usually calls for checking certificate validity, but an inaccurate device clock can also block validation. Correct the clock first when its date or time is wrong. Find out whether the failure follows the site or your setup Change one variable at a time where practical. For example, testing another browser on the same device keeps more conditions constant than changing both the device and network. Outcome Likely investigation path Next action One browser fails; another works Browser-profile or browser-version differences Update the failing browser, then test a private window. Several browsers on one device fail Device clock, software, trust, or connection settings Follow the device repair steps and compare another device. Several devices on one network fail Network path or shared configuration Compare a trusted independent network and check managed-network settings. One site fails across independent devices and networks Site-side HTTPS configuration Contact the operator, or inspect HTTPS configuration if you administer it. Private-window success suggests profile-specific differences in most cases. Extensions, stored site data, and local certificate overrides remain competing explanations; success does not prove which one caused the failure. One website failing across independent setups points toward a site-side problem in most cases. Browser, device, or network troubleshooting takes priority when the failure follows only that environment. Repair browser and device problems one change at a time Start with narrow changes and avoid broad resets. After each step, retry the identical URL; if nothing changes, restore temporary settings before continuing. Enable accurate automatic date and time. Check the displayed date and time afterward, since incorrect time prevents reliable certificate validation. Install available browser and operating-system updates. Old browsers and TLS libraries can fail against modern HTTPS servers. Reopen the browser after updating. Test a private window. If it works, investigate profile-specific differences rather than assuming that cache or an extension is responsible. Delete only the affected site’s stored data if warranted. This can sign you out. Retry before clearing anything broader. Disable extensions individually. Start with recently added extensions, and re-enable each unsuccessful candidate before testing another. Optionally clear SSL state on Windows. Open Internet Options, select Content, choose Clear SSL state, then close and reopen the browser. Clearing Windows SSL state is a separate action from deleting cookies or clearing DNS data. If these checks leave the result unchanged, move to the network or site-side branch instead of repeating them. Test the network without bypassing HTTPS protection Prefer comparison on a trusted network before disconnecting a privacy tunnel or proxy. A changed result makes the connection path or configuration worth investigating in most cases, but does not identify a particular intermediary when several variables changed together. Compare a trusted independent connection. Keep the target URL unchanged and record the result. Use the network’s legitimate captive-portal login if required. Complete the network login before retrying secure sites; do not downgrade the target website to HTTP. Ask the administrator on managed devices. Get authorization before changing proxy or HTTPS-inspection settings. If necessary and authorized, briefly test a direct connection. Temporarily disconnect the tunnel or proxy, avoid sensitive browsing, and reconnect immediately afterward. Success does not prove that the provider’s infrastructure is faulty. Test only the relevant inspection feature. If the problem began after enabling HTTPS scanning, change only that feature briefly, then restore it even if the test fails. Do not bypass certificate warnings or disable all security protection. Enabling obsolete SSL or TLS protocols weakens security rather than providing an appropriate repair. If you own the site, check the HTTPS configuration This branch is for the owner or an authorized administrator. Visitors cannot repair the website’s certificate or server configuration. Check validity dates and hostname coverage. Renew or reissue the certificate when indicated. A certificate for example.com may not cover www.example.com. Check the intermediate certificate chain. Configure the server to send the full chain, not just the site certificate. Check the HTTPS listener and TLS configuration. Confirm that the intended service accepts HTTPS connections. Typical repairs include supporting TLS 1.2 and TLS 1.3 and removing obsolete cipher suites. Validate before a controlled reload. Check the configuration, retain a rollback path, reload according to your server’s procedure, and retest the hostname. Use a public TLS checker only for an authorized public hostname. Private-only services need checks from an authorized client inside their network: private reachability and certificate trust are separate requirements. Know when to stop and report the error Visitors usually cannot repair a site-side HTTPS failure. If one site fails across independent setups, contact its operator; if many sites fail on a managed network, contact the network administrator. Report the hostname, exact error code, time of failure, browser version, and comparison results. Remove tokens, private URL paths, and personal information from screenshots or reports. Stop if the next proposed step requires bypassing the warning. Do not enter credentials or payment details through a connection whose security warning remains unresolved. On this page Start with these checks before changing settings Read the code beneath the warning Find out whether the failure follows the site or your setup Repair browser and device problems one change at a time Test the network without bypassing HTTPS protection If you own the site, check the HTTPS configuration Know when to stop and report the error Author doxx.net Editorial Category troubleshooting Published 6 Oct 2026 Reading time 06 minutes Ask an AI assistant Share this article Related insights Read more articles 6 Oct 2026 security Blocking Encrypted DNS Traffic: What It Means and What to Check Learn what an encrypted DNS warning means, how blocking affects privacy, and how to check device settings, network controls and DNS fallback. doxx.net Editorial 6 min read 6 Oct 2026 privacy Can website owners see who visits? Website owners can see visit data, but usually not your name. Learn how logins, cookies, and identity matches affect privacy and what you can limit. doxx.net Editorial 9 min read 6 Oct 2026 Networking Can You Access Your NAS From Anywhere? Yes, you can access your NAS from outside your home network once you configure remote access. doxx.net Editorial 11 min read Private Everywhere Stop giving the internet everything Keep your browsing, messages, files, and agents private. Get StartedDownload Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Overview - doxx.net URL: https://www.doxx.net/help/overview/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpOverview Overview What doxx.net is, why we built it and how an Agentic Defined Network works. What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## What is doxx.net? - doxx.net URL: https://www.doxx.net/help/overview/what-is-doxx-net/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpWhat is doxx.net? Overview> What is doxx.net? What is doxx.net? doxx.net is an Agentic Defined Network. October 9, 2026 Jump to a section Your network Built on our own infrastructure No network logging Your people, devices and agents on one network Get started doxx.net connects your devices and AI agents on a private network. Browse privately, make calls, send messages and share files. Calls, messages and file transfers are end-to-end encrypted. You can manage the network yourself or give an AI agent permission to set it up for you. 1.Your network When you connect through a doxx.net location, an encrypted tunnel carries traffic from your device to that location. Choose the protections you need, mask your browser profile with Web Privacy, block unwanted domains from reaching your devices with Smart Blocking, and add layers of separation with Onion Routing. doxx.net builds and runs its core network, including its servers, IP addresses and DNS services. 2.Built on our own infrastructure Our core network includes: AS16740: our autonomous network, and our own IP address space. Recursive DNS resolvers: 207.207.200.200 and 207.207.201.201. DNS root and certificate authority. A domain registry with 196 doxx.net TLDs. Bare-metal servers: we own and built them from scratch. Connect devices and run services inside your private network, or use a doxx.net tunnel to reach the public internet. 3.No network logging doxx.net is designed not to keep browsing history or DNS query logs. Read our privacy policy for details. 4.Your people, devices and agents on one network Use one network for your calls, devices, services and agents. Use the app to chat, call and share files with friends. Connect devices and services through a private network. Give your agents a way to communicate and manage networking on your behalf. You do not need to configure every feature to get started. Your first step is simply to install the app and connect. 5.Get started The doxx.net app is available for iOS, macOS and Android. On Windows and Linux, connect using WireGuard and a configuration from the doxx.net web portal. Start with Download and install. On this page Your network Built on our own infrastructure No network logging Your people, devices and agents on one network Get started Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Why doxx.net? - doxx.net URL: https://www.doxx.net/help/overview/why-doxx-net/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpWhy doxx.net? Overview> Why doxx.net? Why doxx.net? Connect your devices, protect your browsing and manage a private network with your AI agents. October 9, 2026 Jump to a section Why a private network? A private network you control Agents: build and manage your network autonomously doxx.net: an Agentic Defined Network in the palm of your hand 1.Why a private network? Everyday online activity passes through services run by different companies. Those services can collect connection data even when the content itself is encrypted. AI agents add another challenge: they need access to services and data without being able to reach everything. Network controls help you decide where they can connect and what they can access. 2.A private network you control Use doxx.net to connect your devices, run private services and communicate securely. Calls, messages and file transfers are end-to-end encrypted between devices. We build and run the core network, including our own servers, IP addresses and DNS. You can connect through locations across six continents and manage your network yourself or with an AI agent. 3.Agents: build and manage your network autonomously doxx.net allows you to manage and build your network entirely with your agents. Through doxx.net’s API and Model Context Protocol (MCP) tools, an authorized agent can create tunnels and manage IP addresses, DNS settings and firewall rules, with the access that you give it. Tell your agent what you want your network to do. With the doxx.net skill and the right permissions, your agent can fully and autonomously manage your network. 4.doxx.net: an Agentic Defined Network in the palm of your hand Agentic Defined Networking. Allow your agents to set up networks for you, call you, chat with you, lease your own IP addresses, and configure your firewall. Call, message and share files privately. Your calls, video chats, messages and file transfers are end-to-end encrypted. Let the network quietly catch threats before you ever see them. Smart Blocking combines 30 filter lists with a neural network that catches threats no static list has seen, automatically protecting you and your agents from malicious phishing and malware sites. Stay connected even where tunnels are blocked. Covert Networking uses six protocols designed to make private-network traffic look like ordinary web browsing. Make it harder for sites to track you. Web Privacy masks identifying details about your browser and device to help prevent tracking across websites. Keep your identity and activity separate by design. Onion routing moves your traffic through multiple servers before it exits, so no single point knows who you are and what you're doing at the same time. Use private names for your services. Name your private services and manage certificates for the devices that use them. See the feature overviews for what each part of the platform does. On this page Why a private network? A private network you control Agents: build and manage your network autonomously doxx.net: an Agentic Defined Network in the palm of your hand Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## What is an Agentic Defined Network? - doxx.net URL: https://www.doxx.net/help/overview/what-is-an-agentic-defined-network/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpWhat is an Agentic Defined Network? Overview> What is an Agentic Defined Network? What is an Agentic Defined Network? An Agentic Defined Network lets an AI agent help build and manage the network it uses. September 30, 2026 Jump to a section What your agent can manage Agent permissions Get started Instead of handling each setting yourself, you can ask your agent to work through doxx.net's networking tools on your behalf. 1.What your agent can manage An agent can configure connections, manage DNS, set firewall rules, connect services, and more. It can also communicate with you through doxx.net's private channels, so you can tell your agent directly on the app what you would like it to do. For example, you could ask an agent to connect a cloud server to your private network so you can reach a service running there. 2.Agent permissions Your agent's access depends on the permissions you give it. Decide what it should manage and keep control of its access. Limit your agent to a geofence or restrict it to certain IP addresses. Use a separate, limited credential for an integration instead of sharing your main account token. 3.Get started Ask your agent to read config.doxx.net and explain the setup you need before making changes. For an overview of identities, gateways and access revocation, see Agentic Defined Networking. On this page What your agent can manage Agent permissions Get started Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Zero Network Logging - doxx.net URL: https://www.doxx.net/help/overview/zero-network-logging/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpZero Network Logging Overview> Zero Network Logging Zero Network Logging doxx.net servers were built from the ground up not to keep activity logs such as browsing history or DNS queries. September 30, 2026 Jump to a section Features Common questions For more information refer to our privacy policy. 1.Features Keep browsing history and DNS-query history out of retained network-activity logs. Separate the information needed to run your account from a record of what you do online. Read the privacy policy for the scope of the no-activity-logs commitment: doxx.net/privacy. 2.Common questions Does this mean doxx.net stores nothing at all? No. Account and configuration information, such as your tokens, tunnel settings and subscription status, is different from browsing or DNS-query history. How can I see network activity in the app if there are no activity logs? Showing live feedback isn't the same as retaining a history of your browsing. doxx.net only holds the threats it blocked, and only temporarily. The privacy policy describes this opt-in dashboard data, held briefly in memory. Does this clear the history in my browser? No. The policy describes what doxx.net retains. Your browser, the sites you use and your own devices can have their own records. On this page Features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Quick Start - doxx.net URL: https://www.doxx.net/help/quick-start/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpQuick Start Quick Start Download the app, create your account, connect and share the network. Download and install Create your account Connect to the network Share the network Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Download and install - doxx.net URL: https://www.doxx.net/help/quick-start/download-and-install/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpDownload and install Quick Start> Download and install Download and install Protect your personal devices and manage your network from the doxx.net app. September 30, 2026 Jump to a section iPhone, iPad and Mac Android Windows LinuxLimitations Download doxx.net on iOS, macOS or Android to get started. If you use Windows or Linux, install WireGuard and connect it to doxx.net through the web portal. 1.iPhone, iPad and Mac Open the doxx.net App Store listing and install the app. Once installed, open doxx.net and continue to Create your account. 2.Android Open the doxx.net Google Play listing and install the app. Open it when the installation finishes, then create your account. 3.Windows Download and install the Windows client from WireGuard's official download page. Create your doxx.net account in the web portal. Follow Connect to the network to download and import your doxx.net tunnel configuration. Keep downloaded tunnel configuration files private. They contain a private key that should not be shared with other people. 4.Linux Install WireGuard using the instructions for your Linux distribution. Then create your account in the doxx.net web portal. The portal includes Linux instructions under: Tunnel Settings → Configuration → Install WireGuard → Linux. Once you have WireGuard installed, see Connect to the network to configure a doxx.net tunnel. Keep downloaded tunnel configuration files private. They contain a private key that should not be shared with other people. Limitations The doxx.net app is currently not supported on Linux or Windows. To use our network and remain protected online, you can still get a subset of our core features (encrypted tunnel and DNS) through the standard WireGuard client. On this page iPhone, iPad and Mac Android Windows LinuxLimitations Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Create your account - doxx.net URL: https://www.doxx.net/help/quick-start/create-your-account/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpCreate your account Quick Start> Create your account Create your account Creating your account is simple. September 30, 2026 Jump to a section Create your account Save your token and recovery codes Finish your profile Create your account in the doxx.net web portal before installing the app. 1.Create your account Navigate to the doxx.net web portal. Choose Create your account, and follow the instructions on the screen. Accept the terms and conditions. Save your recovery codes in a secure place. Add your payment method to start your free beta trial for 30 days. You pay nothing until the 30-day trial ends. 2.Save your token and recovery codes Your account token is the credential you use to sign in. Save it in a password manager and keep it private. After the token, you will be shown 10 recovery codes. Save them somewhere secure, including an offline copy. This is the only time those codes are displayed. Never send your token or recovery codes to a friend as an invitation. Use the app's invitation or seat-sharing flow instead. 3.Finish your profile Follow the prompts to set up your profile, then move on to Connect to the network. On this page Create your account Save your token and recovery codes Finish your profile Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Connect to the network - doxx.net URL: https://www.doxx.net/help/quick-start/connect-to-the-network/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpConnect to the network Quick Start> Connect to the network Connect to the network Choose a location and connect to get on the doxx.net network. September 30, 2026 Jump to a section Connect on the app Choose a location Choose a connection mode Connect on Windows or LinuxImportant The app handles your connection on iOS, macOS and Android; Windows and Linux use a downloaded WireGuard configuration. 1.Connect on the app Open doxx.net. Choose a connection location. Select Connect. Allow the system prompts to add the network configuration and to access your local network. The local network prompt lets you use AirPlay and other local connections while you are connected to the doxx.net network. Once you see "you're safe." and the blue toggle in the top right, you’re in. 2.Choose a location To find a location open Network → Location. Feel free to filter by selecting the filter icon beside the search bar. Search by speed (latency), name, or region. 3.Choose a connection mode To find the connection modes open Network → Mode. Choose a mode according to your preferred usage style: Easy Mode: A simplified connection with automatic fast-server selection and DNS filtering. Security: The recommended mode for blocking ads, trackers and malware, with firewall, DNS-bypass and kill-switch protections. Tin Foil Hat: Stronger filtering, Onion Routing and WSS transport. Requires Pro. Some websites may not work. Streaming, Human Rights and Raw modes are coming soon. Heads up: Switching modes can reset your custom settings and stop your connection from using its saved profile or dedicated IP. If you’ve set any of these up, check before you switch. 4.Connect on Windows or Linux Sign in to the web portal. Open My Network → Tunnel List and select + New WireGuard Tunnel. Select your desired tunnel location and Create Tunnel. Open the tunnel's Tunnel Settings → Configuration. Select Download → Download Standard Config. This configuration includes both IPv4 and IPv6. Import the downloaded .conf file into WireGuard and activate the tunnel. Important Download a separate configuration for each device. Keep each file private. On Windows, choose Import tunnel(s) from file. On Linux, the portal's Install WireGuard → Linux tab links to the platform instructions. On this page Connect on the app Choose a location Choose a connection mode Connect on Windows or LinuxImportant Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Share the network - doxx.net URL: https://www.doxx.net/help/quick-start/share-the-network/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpShare the network Quick Start> Share the network Share the network Add someone to talk privately, share a seat on your plan, or bring another device onto the network. September 30, 2026 Jump to a section Invite a friend Talk on the network Share a seat Connect your own devices Each action serves a different purpose: adding a friend connects you for communication, while sharing a seat provides access to the network through your plan. 1.Invite a friend Open the app and select Comms. Select + at the top right, beside Chats and Starred. Show your QR code or send your invitation link. If your friend already has the app, they can scan the QR through Comms → + → Add Friends → Scan Friend's QR Code. New users can scan the invitation with their phone camera and follow the download and account-setup instructions. 2.Talk on the network Once connected as friends, you can chat, call, send voice messages and share files. See P2P E2EE Comms for an overview. 3.Share a seat Open Account → Plan sharing → Share a seat, then send the link or let the recipient scan the QR code. They can follow the setup flow to join. For the full steps and plan notes, see Share seats. 4.Connect your own devices Use the same Share a seat flow to bring another of your devices onto the network. For an agent-managed setup, ask your agent to read config.doxx.net and help you configure the connection. On this page Invite a friend Talk on the network Share a seat Connect your own devices Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Features - doxx.net URL: https://www.doxx.net/help/features/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpFeatures Features What each part of the doxx.net platform does. Agentic Defined Networking Privacy P2P E2EE Comms Security – DNS Connectivity & Routing Private Networking & Services Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Agentic Defined Networking - doxx.net URL: https://www.doxx.net/help/features/agentic-defined-network/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpAgentic Defined Networking Features> Agentic Defined Networking Agentic Defined Networking AI agents act on your behalf. Their network should too. Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Agentic Defined Networking overview - doxx.net URL: https://www.doxx.net/help/features/agentic-defined-network/overview/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpAgentic Defined Networking overview Features> Agentic Defined Networking> Agentic Defined Networking overview Agentic Defined Networking overview AI agents act on your behalf. Their network should too. October 1, 2026 Jump to a section Getting your Agent set up with doxx.net Features Setting up a Network Security AgentCheck your account Install the doxx.net skill Give it dedicated access Review and test the connection Agent Gateway Common questions Related articles doxx.net brings agentic network control and communication together. You and your agents can exchange encrypted messages and files, and authorized agents can build and manage your network through the doxx.net API & MCP. Control what your agents can access, who they talk to, and what they can change. 1.Getting your Agent set up with doxx.net Give your agent the doxx.net skill to configure and manage your network. 2.Features Use the doxx.net skills for Claude Code, OpenAI Codex or OpenClaw. Start the Network Wizard for guided setup, including locations, device connections and optional DNS settings. Give the agent a dedicated credential instead of sharing your main account token. Check the existing setup and review changes before the agent applies them. 3.Setting up a Network Security Agent Check your account You’ll need a doxx.net account and a subscription that supports your desired setup. Install the doxx.net skill Install the skill for your AI provider using the doxx.net skills guide. Ask your agent to read config.doxx.net and help set up your network. Give it dedicated access Your agent needs an access token to configure your network. To create one: Open the doxx.net portal and go to Account → Auth Tokens → New Token. Choose the role your agent needs. For Network Admin agents, we recommend Network Admin Token. Store the token securely. Don’t paste it into the conversation. Review and test the connection Review the plan before the agent changes your network. After setup, ask it to test the connection and summarize what changed. Agent Gateway Chatting and exchanging files with your agent through Comms is an additional setup. Ask your agent to include doxxGateway setup in its network configuration. 4.Common questions Can any AI chat app set this up for me? Use a coding agent that supports the doxx.net skill, such as Claude Code or Codex. It must be able to read the instructions and run the required tools on the computer or server you’re connecting. What does this allow me to do? Within the access you grant, your agents can create tunnels, configure firewalls and change DNS settings. Which role should I give the token? For network configuration, use Network Admin (net-admin). Use read-only when the agent only needs to inspect information. Don't give it full Admin access for a task that doesn't need it. What does storing the token securely mean? Follow the setup guide to add the token on the computer or server running the agent's tools, using its credential storage or a restricted local file (such as a .env file). Don't paste it into the conversation. Does installing the skill also connect the agent to Comms? No. The skill helps it manage your network. doxxGateway is the additional setup for messaging and exchanging files with the agent. 5.Related articles Setting up with AI: install the skill and generate an agent token. API and MCP: what an authorized agent can do on your network. Agent Gateway: chat and exchange files with your agent. Webhooks: bring updates from your own systems into doxx.net Chat. On this page Getting your Agent set up with doxx.net Features Setting up a Network Security AgentCheck your account Install the doxx.net skill Give it dedicated access Review and test the connection Agent Gateway Common questions Related articles Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Setting up with AI - doxx.net URL: https://www.doxx.net/help/features/agentic-defined-network/setting-up-with-ai/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpSetting up with AI Features> Agentic Defined Networking> Setting up with AI Setting up with AI Give your agent the doxx.net skill to configure and manage your network. October 1, 2026 Jump to a section Features Setting up a Network Admin agentCheck your account Install the doxx.net skill Give it dedicated access Review and test the connection Agent Gateway Common questions 1.Features Use the doxx.net skills for Claude Code, OpenAI Codex or OpenClaw. Start the Network Wizard for guided setup, including locations, device connections and optional DNS settings. Give the agent a dedicated credential instead of sharing your main account token. Check the existing setup and review changes before the agent applies them. 2.Setting up a Network Admin agent Check your account You’ll need a doxx.net account and a subscription that supports your desired setup. Install the doxx.net skill Install the skill for your AI provider using the doxx.net skills guide. Ask your agent to read config.doxx.net and help set up your network. Give it dedicated access Your agent needs an access token to configure your network. To create one: Open the doxx.net portal and go to Account → Auth Tokens → New Token. Choose the role your agent needs. For Network Admin agents, we recommend Network Admin Token. Store the token securely. Don’t paste it into the conversation. Review and test the connection Review the plan before the agent changes your network. After setup, ask it to test the connection and summarize what changed. Agent Gateway Chatting and exchanging files with your agent through Comms is an additional setup. Ask your agent to include doxxGateway setup in its network configuration. 3.Common questions Can any AI chat app set this up for me? Use a coding agent that supports the doxx.net skill, such as Claude Code or Codex. It must be able to read the instructions and run the required tools on the computer or server you’re connecting. What does this allow me to do? Within the access you grant, your agents can create tunnels, configure firewalls and change DNS settings. Which role should I give the token? For network configuration, use Network Admin (net-admin). Use read-only when the agent only needs to inspect information. Don't give it full Admin access for a task that doesn't need it. What if my agent goes rogue or I want to revoke its access? Revoke the agent’s doxx.net token to remove its access to your network. What does storing the token securely mean? Follow the setup guide to add the token on the computer or server running the agent's tools, using its credential storage or a restricted local file (such as a .env file). Don't paste it into the conversation. Does installing the skill also connect the agent to Comms? No. The skill helps it manage your network. doxxGateway is the additional setup for messaging and exchanging files with the agent. On this page Features Setting up a Network Admin agentCheck your account Install the doxx.net skill Give it dedicated access Review and test the connection Agent Gateway Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## API and MCP - doxx.net URL: https://www.doxx.net/help/features/agentic-defined-network/api-and-mcp/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpAPI and MCP Features> Agentic Defined Networking> API and MCP API and MCP Through doxx.net’s API and Model Context Protocol (MCP) tools, an authorized agent can create tunnels and manage IP addresses, DNS settings and firewall rules, with the access that you give it. October 1, 2026 Jump to a section Features Common questions Tell your agent what you want your network to do. Give it the doxx.net skill and the permissions it needs to manage your network. See Setting up with AI for the steps. For the API and MCP instructions, point your agent to config.doxx.net. 1.Features Within the permissions you grant, your agent can: Create tunnels. Manage IP addresses. Configure DNS. Update firewall rules. Enable ad blocking. Check connection status. Manage private domain names and their DNS records through the documented network tools. 2.Common questions What can I ask the agent to do? Try a specific request, such as ‘connect these two devices privately,’ ‘enable ad blocking on this tunnel,’ or ‘show me which devices are connected.’ Ask it to explain the changes before applying them. Do I need to know the API commands? No. The skill and configuration reference give the agent the technical instructions. You describe the result you want and decide what access to allow. Will I be asked to approve every API call? Don't assume there is an approval popup for every change. Token permissions control what the tools can do; set your approval requirements in the agent's workflow as well. Does allowing the agent to configure my network automatically let it chat with friends? No. Network-management permissions and gateway contact permissions are separate. On this page Features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Agent Gateway - doxx.net URL: https://www.doxx.net/help/features/agentic-defined-network/agent-gateway/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpAgent Gateway Features> Agentic Defined Networking> Agent Gateway Agent Gateway The Agent Gateway allows you to chat with an agent (H2A) through the same communications environment you use with people, with end-to-end encryption. September 30, 2026 Jump to a section Features Setting up Agent Gateway Chat (With AI) Common questions Agent-to-agent (A2A) lets paired agents communicate with each other when their owners approve it. Set up your agent gateway by asking your agent to set up doxxGateway or you can do it yourself in the app: Manage your agent gateway by navigating to: Account → Settings ⚙ → P2P E2EE Comms → Agent Gateway. Agent Gateway is included with Pro. 1.Features Chat with your agent and exchange files in the same Comms environment you use with people. Connect a compatible agent runtime through the gateway's API or MCP tools. Host the gateway on a Mac or Linux server while using your phone as the conversation window. Allow paired agents to communicate when their owners approve it. 2.Setting up Agent Gateway Chat (With AI) If you already have a Network Admin Agent set up, you can ask it to configure doxxGateway. If not, follow the steps below. Before you start, you need the doxx.net app and a Mac, Linux machine or container where your agent can run commands. Create a token. In the doxx console, create a net-admin token. Don't use your main admin token. Save the token on your server. Put it in ~/.config/doxxnet/token, not in the AI chat. Tell your agent to read config.doxx.net and follow the agent gateway setup. Configure the settings with your agent according to your network needs. Once your agent is connected to your network you should see its name in your comms friends list! Test it out and send your agent a message. Not replying? Tell your agent to check the gateway log and make sure it's running the latest version. 3.Common questions How do I ask my agent to set it up? You can say: Read config.doxx.net and help me set up doxxGateway so I can chat with you and exchange files. Check what's already configured, explain the setup and ask before changing existing connections. Guide me through providing credentials outside this chat, then test that you can receive a message and reply. Does the agent run on my phone? Not in the documented gateway setup. Host it on a supported Mac or Linux machine, then talk to it from your phone. Why does the network show connected but the agent doesn't reply? The gateway connection and the agent listening for messages are separate. If the agent session closes or the host sleeps, it may stop answering even though a tunnel is connected. For replies while you're away, keep both the host and the message-handling process running. Can agents talk to each other automatically? Agent-to-agent chat must be enabled for both agents and the pairing approved by their owners. Chat permission doesn't automatically grant access to the other machine's services. Does encryption change what my AI provider does with messages? No. doxx.net protects the connection between its endpoints. Once your agent receives a message, how its AI runtime processes or stores it is a separate matter. On this page Features Setting up Agent Gateway Chat (With AI) Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Webhooks - doxx.net URL: https://www.doxx.net/help/features/agentic-defined-network/webhooks/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpWebhooks Features> Agentic Defined Networking> Webhooks Webhooks Bring updates from your own systems straight into doxx.net Chat. October 1, 2026 Jump to a section Setting up WebhooksImportant Additional features Common questions A webhook gives a script, service or automation its own identity to post messages under, for example, a backup notification or a server alert. Messages arrive in your thread by default. You decide which friends and groups the webhook can also post to. It’s a post-only identity, not an AI agent that reads and answers conversations. 1.Setting up Webhooks In the app, open Account → Agents and Webhooks. Select + at the top right, then New Webhook. Enter a Name for the webhook. Choose its Host: the device whose gateway will run it. Select Create. Open Credentials for the gateway address, certificate, API key and connection instructions. Use these to configure the system that will send messages. Configure your system to send messages to the endpoint shown under Receiver. Send a test message and check that it arrives in Chat. If needed, use Reach to link a friend or add the webhook to an eligible group. Important The setup information contains secrets. Put it in the sending system’s protected configuration, not in a public message or screenshot. For a Linux host, follow the doxxGateway setup guide. The creation screen directs Linux users to that setup instead. 2.Additional features Its own identity: Set a name, photo and message of the day so people can recognize its posts. Controlled reach: Post to your own thread, with additional friends and groups enabled by you. Host status: See whether the host is online, answering on the mesh and delivering messages. Move host: Move the identity to another host. Moving revokes its old host credentials and creates fresh ones on the new host. Separate credentials: Revoke one integration’s certificate and API key without stopping integrations using other credentials. Chat log: Review the identity’s conversations in a read-only view. 3.Common questions Can it post to all my friends and groups? No. You choose its reach. A linked friend must accept the identity. The group picker offers groups you administer that allow agents. What happens if the host goes offline? The gateway running there stops working until the host is available again. For a webhook that needs to stay available, use a host that stays online, such as a Linux server. Don’t assume missed submissions will automatically be retried. How do I stop one system from posting? Find its credential under Credentials and select Revoke. Other credentials keep working. On this page Setting up WebhooksImportant Additional features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Privacy - doxx.net URL: https://www.doxx.net/help/features/privacy/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpPrivacy Features> Privacy Privacy Reduce what your connection reveals and choose the level of protection that fits what you're doing. Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Privacy overview - doxx.net URL: https://www.doxx.net/help/features/privacy/overview/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpPrivacy overview Features> Privacy> Privacy overview Privacy overview Websites can recognize patterns in your browser and device, while a network can block a connection because it looks like tunnel traffic. September 30, 2026 doxx.net has separate controls for every problem. Use them to reduce what your connection reveals and choose the level of protection that fits what you're doing. Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Covert Networking - doxx.net URL: https://www.doxx.net/help/features/privacy/covert-networking/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpCovert Networking Features> Privacy> Covert Networking Covert Networking Evade censorship and firewalls with stealth transport protocols that make your tunnel traffic look like normal web traffic. September 30, 2026 Jump to a section Features Alternate Transport ProtocolsWebSocket (TCP 443, pinned 4096 bit certificate) SIP/VoIP (UDP 5060, RTP media stream) ICMP Echo (Ping requests/reply tunneling) QUIC (UDP 443, HTTP/3 protocol) Cloudflare WSS (TCP 443 CDN proxied WebSocket) HTTPS (TCP 443, standard web traffic) UDP port selection Common questions Covert Networking disguises tunnel traffic as other types of traffic the network expects to see. It gives you another way to connect to a network when ordinary tunnel traffic is restricted. It won't get around every block, but it addresses a different problem from encryption: getting the connection through in the first place. 1.Features Use alternative transports, including HTTPS and WebSocket, when a network restricts ordinary tunnel traffic. Disguise the connection's traffic pattern while retaining an encrypted connection. Choose another way to reach doxx.net on restrictive networks. To configure and learn more about your covert networking options navigate to: Account → Settings ⚙ → Privacy → Covert Networking. 2.Alternate Transport Protocols WebSocket (TCP 443, pinned 4096 bit certificate) Makes your connection look like standard HTTPS traffic, with an additional layer of encryption. Supports fast, two-way communication, but packet loss can slow it down. Switching networks, such as from Wi-Fi to cellular, requires a reconnection. SIP/VoIP (UDP 5060, RTP media stream) Makes your connection resemble internet-call traffic. Its low overhead suits real-time communication, and some networks give voice traffic priority. It may be blocked on networks that restrict internet calls. ICMP Echo (Ping requests/reply tunneling) Carries your connection through ping requests and replies, which some restrictive networks still allow. Useful for basic connectivity and messaging, but its lower bandwidth makes it less suitable for heavy browsing. Some router and carrier networks can also cause timing issues. QUIC (UDP 443, HTTP/3 protocol) Makes your connection resemble modern web traffic, with a UDP-based transport designed for performance. Supports keeping the connection when your IP address changes, though this behavior hasn’t been extensively tested and the connection may occasionally stall. Cloudflare WSS (TCP 443 CDN proxied WebSocket) Routes an encrypted WebSocket connection through Cloudflare’s network. Your inner traffic stays encrypted, but Cloudflare can see the source and destination IP addresses. Network changes can also interrupt the connection. HTTPS (TCP 443, standard web traffic) Makes your connection resemble ordinary web browsing. Extra Setting: supports routing through an HTTPS proxy. It adds another layer of encryption, but has higher latency and uses more bandwidth than WebSocket. UDP port selection Choose the destination port for direct WireGuard connections: 51820 (the default), 53, 443, 123 or 5353. This gives you alternatives when a network blocks the usual port. You can't choose a port while using an alternate transport protocol. 3.Common questions Will this work through every firewall? No. Different networks block different types of traffic. Covert Networking gives you alternatives, not a guarantee that every restriction can be bypassed. Is disguising traffic the same as encrypting it? No. Encryption protects the contents of your connection. Covert Networking changes how that connection travels and appears to the network carrying it. Why does my connection drop when I switch from Wi-Fi to cellular? WebSocket and Cloudflare WSS can disconnect when your network or IP address changes. You’ll need to reconnect. QUIC supports connection migration, but this behavior hasn’t been extensively tested. Can I connect through an HTTPS proxy? Yes. Open HTTPS, enable it, then turn on HTTPS Proxy Server. Enter the proxy’s Host and Port, and add a username and password if required. Proxy credentials are stored on your device and aren’t sent to doxx.net. You’ll need to enter them again if you reinstall the app. Does selecting UDP port 443 turn on HTTPS? No. The UDP Port setting changes the destination port for direct WireGuard connections. The HTTPS option is a separate transport. Choosing a familiar port doesn’t, by itself, make the traffic use that protocol. Which port can I try if the default is blocked? For more restrictive networks such as hotel, airport or corporate networks, try 53 or 443. Neither is guaranteed to be allowed. On this page Features Alternate Transport ProtocolsWebSocket (TCP 443, pinned 4096 bit certificate) SIP/VoIP (UDP 5060, RTP media stream) ICMP Echo (Ping requests/reply tunneling) QUIC (UDP 443, HTTP/3 protocol) Cloudflare WSS (TCP 443 CDN proxied WebSocket) HTTPS (TCP 443, standard web traffic) UDP port selection Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Onion Routing - doxx.net URL: https://www.doxx.net/help/features/privacy/onion-routing/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpOnion Routing Features> Privacy> Onion Routing Onion Routing Onion routing adds an extra layer of separation when privacy matters more than taking the shortest route. September 30, 2026 Jump to a section Features Common questions Your traffic is split, entering the doxx.net network, and leaving through multiple exit locations simultaneously. 1.Features Separate the place your traffic enters doxx.net from where it exits. Add another routing step when privacy matters more than the shortest path. Use a routing control that serves a different purpose from disguising the connection with Covert Networking. To enable onion routing and learn more navigate to: Account → Settings ⚙ → Privacy → Onion Routing. 2.Common questions Why can Onion Routing feel slower? The connection has more distance or routing steps to cover. That can add delay, so it may feel less responsive than a more direct route. Does Onion Routing replace Covert Networking? No. They address different problems: routing separation versus getting a disguised connection through network filters. Does it make me anonymous when I sign in to a website? No. The site can still recognize the account you sign in with. Changing the route doesn't remove information you give the destination. On this page Features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Web Privacy - doxx.net URL: https://www.doxx.net/help/features/privacy/web-privacy/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpWeb Privacy Features> Privacy> Web Privacy Web Privacy Your browser details, such as location, language, OS, and hardware can form a recognizable fingerprint. September 30, 2026 Jump to a section Features Common questions Web Privacy masks those browser signals so different sites see different identities. Web Privacy also changes device and network signals, keeping them consistent with the browser profile. You can preserve your real profile where you want to be recognized. These tools don't make every action anonymous: signing in to a site still identifies you through your account. 1.Features With Web Privacy, you can: Prevent advertisers from linking your activity across sites. Appear to be browsing from any country. Each site sees a different, consistent identity so patterns cannot be linked. Mask browser details that can be used to recognize you across visits. Use coordinated browser and network profiles instead of sending a mismatched set of signals. Keep your real profile for sites where you want to be recognized. To set up Web Privacy: navigate to: Account → Settings ⚙ → Privacy → Web Privacy. Install the doxx.net Certificate on your computer or mobile phone (instructions on the app). Click enable web privacy. Configure your location and profile. 2.Common questions What is a browser fingerprint? It's a combination of details, such as your screen size, fonts and language, that can help a website distinguish your browser from others. Is changing my IP address enough to change my fingerprint? No. Browser and device details are separate signals. That's why fingerprint protection does a different job from choosing an exit location. Can a site still recognize me after I log in? Yes. Logging in identifies your account even if some browser or network details are masked. On this page Features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Self-Destruct PIN - doxx.net URL: https://www.doxx.net/help/features/privacy/self-destruct-pin/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpSelf-Destruct PIN Features> Privacy> Self-Destruct PIN Self-Destruct PIN Set a separate PIN to wipe locally stored doxx.net data if you're pressured to unlock the app. October 1, 2026 Jump to a section Features Common questions Entering that PIN triggers a permanent local wipe of all doxx.net data. Read the warning before setting it up. You can't undo the local wipe. It does not delete your doxx.net account. 1.Features Set a separate PIN for an emergency local wipe. Remove locally stored doxx.net data instead of opening it when that PIN is entered. Keep this emergency action separate from ordinary account deletion. To set up the PIN, open: Account → Settings ⚙ → Privacy → Self-Destruct PIN. 2.Common questions Can I use the PIN I use to unlock the app normally? No. It's a separate emergency PIN that triggers a total wipe of the app. Keep it distinct from the PIN you use for normal access. Can I restore my data after wiping? No. Most of the data will be lost unless stored on other devices. Does it delete my doxx.net account? No. A local wipe removes all the data from your doxx.net app. Use the account-deletion process if you want to remove the account itself. Does it remove copies other people have? No. A wipe on your device doesn't erase messages or files someone else has already saved on theirs. On this page Features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## P2P E2EE Comms help - doxx.net URL: https://www.doxx.net/help/features/p2p-e2ee-comms/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpP2P E2EE Comms Features> P2P E2EE Comms P2P E2EE Comms Chat, call and share files through encrypted, device-to-device connections. P2P E2EE Comms overview Chat Call and Video NetDrop Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## P2P E2EE Comms overview - doxx.net URL: https://www.doxx.net/help/features/p2p-e2ee-comms/overview/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpP2P E2EE Comms overview Features> P2P E2EE Comms> P2P E2EE Comms overview P2P E2EE Comms overview doxx.net lets you chat, call (video and voice!), and share files with true privacy through encrypted, device-to-device connections, without a provider storing your conversations in the middle. September 30, 2026 doxx.net doesn't hold your messages, files or call records. You can keep in touch without handing over a phone number, and use the same communication tools to talk to supported agents. See each section for common issues and questions. 1.Get started To talk on the network, you need friends first. Open Comms and invite a friend. A WireGuard connection on its own doesn't give you the app's chat or calling interface. This section is only applicable to doxx.net app users (MacOS, iOS, Android). Doxxcomms applies to all plan levels. Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Chat - doxx.net URL: https://www.doxx.net/help/features/p2p-e2ee-comms/chat/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpChat Features> P2P E2EE Comms> Chat Chat Chat privately with your friends and agents on doxx.net. September 30, 2026 Jump to a section Additional features Common questions 1.Additional features Only approved friends can message you so no spam or ad messages. Send voice messages with fun audio filters. Use Auto-Translate to communicate with friends in different languages without copying private messages into a separate translation service. The translation happens on your device. Send photos, videos, and files. Turn on real-time chat to see each other typing live. To configure Chat settings, go to Account → Settings ⚙ → P2P E2EE Comms → Chat. 2.Common questions How do I know my message was delivered? One check (✔️): the message is sending. Two checks (✔️✔️): the message was delivered. What if my friend is offline when I send the message? If your friend isn't connected to the doxx.net network, you will see “offline” next to their profile at the top of the screen. It is delivered only if you are still connected when they come online. Leave your phone connected to the network and this will work in the background, even while your phone is asleep (but not powered down). Why did I lose all my messages? Because messages are stored on your device only, signing out of your account will result in the loss of all messages. To restore your chats, select the restore prompt when you sign in. Messages are restored one chat at a time, and each contact must approve the restoration. How do I talk to my agents? To talk to your agent please see the Agent Gateway setup guide. Does Auto-Translate send my messages to another service? No. Translation happens on your device, so you don't need to copy the conversation into a separate translation app. What is real-time chat? It lets you see each other typing live, instead of waiting for a finished message. Turn it on when you want the conversation to feel more immediate. Can I message someone who isn't my friend? You need to connect as friends first. Open Comms and invite the person you want to talk to. Once they've accepted, you're ready to chat. On this page Additional features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Call and Video - doxx.net URL: https://www.doxx.net/help/features/p2p-e2ee-comms/call-and-video/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpCall and Video Features> P2P E2EE Comms> Call and Video Call and Video doxx.net connects your calls directly to your friends, with no call server in the middle and fresh encryption keys for every call. September 30, 2026 Jump to a section Additional features Common questions doxx.net doesn't keep a call history to hand over, and only accepted friends can call you so no spam calls or messages. 1.Additional features Only your friends can ring you so no spam calls or messages. Video and voice effects to spice things up Video and Voice calls Fresh encryption keys for each call, rather than reusing one set for every conversation. Call directly through doxx.net without sharing a phone number. To configure Voice and Video settings go to: Account → Settings ⚙ → P2P E2EE Comms → Video and Audio Calling. 2.Common questions Who can call me? Only accepted friends. Someone having your phone number doesn't give them access to your doxx.net calls, which means no unwanted spam or promotional calls. Can I make a call using the standard WireGuard app? No. A WireGuard connection gets the device onto the network, but it doesn't include the doxx.net calling interface. Use the doxx.net app for voice and video calls. What's the difference between a call and a voice message? A call is a live conversation. A voice message is a recording you send in Chat for your friend to play back. Does doxx.net keep a recording of my call? doxx.net doesn't store your call content. The people taking part still control their own devices, so encryption isn't a promise that another participant cannot record a conversation. To configure NetCall settings go to: Account → Settings ⚙ → P2P E2EE Comms → Video and Audio Calling. On this page Additional features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## NetDrop - doxx.net URL: https://www.doxx.net/help/features/p2p-e2ee-comms/netdrop/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpNetDrop Features> P2P E2EE Comms> NetDrop NetDrop Transfer files between your devices, friends and supported agents on doxx.net. October 1, 2026 Jump to a section To send a file Additional features Common questions Send files directly between connected devices without a doxx.net cloud-storage copy. 1.To send a file In the app, open Comms → NetDrop → 📁 at the top right and choose a file. Select the recipient. The recipient must accept the transfer request on their device. Confirm the transfer. Transfers use two layers of encryption: between devices and through the tunnel, with fresh keys for each transfer. Our integrity checks confirm that the received file matches the file sent. To configure NetDrop, open: Account → Settings ⚙ → P2P E2EE Comms → NetDrop. 2.Additional features Pick up where you left off. Interrupted transfers resume where they stopped. Devices verify each other first. Both devices confirm each other’s identity before any file data moves. Verified on arrival. A transfer only shows as verified after the receiving device confirms that its copy matches the original. 3.Common questions How do I know my file was transferred? Open NetDrop → Sent. If the file appears there, your contact has received it. What does the progress bar show? The bar shows download progress in blue or upload progress in pink. Does the sender need to stay online? The file stays on the sending device until the receiver requests it. Once another device has a verified copy, that device can serve future downloads too. The original sender doesn’t have to stay online, but a device holding the file needs to be reachable. Where are my received files saved? On iOS, received photos, videos and files are saved in Photos or Files if you give doxx.net the required access. Files accepted through NetDrop outside Chat save to Photos or your documents. Do we have to be next to each other? No. NetDrop works between connected devices over doxx.net, so the person receiving the file doesn't have to be in the same room or on your Wi-Fi. Will my photos and videos lose quality? NetDrop transfers the original file. It doesn't need to reduce the quality to fit a messaging-service upload. Does doxx.net keep a copy of the file? No cloud-storage copy is held by doxx.net. The sender and recipient can still keep their own copies on their devices. What do the integrity checks do? They check that the file received matches the file sent. That isn't a malware scan or a guarantee that the file is safe to open. Only open files from people you trust. On this page To send a file Additional features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## DNS security help - doxx.net URL: https://www.doxx.net/help/features/security/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpSecurity – DNS Features> Security – DNS Security – DNS With doxx.net, protection begins even before the website finishes loading. Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Security overview - doxx.net URL: https://www.doxx.net/help/features/security/overview/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpSecurity overview Features> Security – DNS> Security overview Security overview With doxx.net, protection begins even before the website finishes loading. September 30, 2026 Your devices often contact malicious or tracking domains in the background. Block unwanted DNS requests and encrypt queries sent to doxx.net’s resolvers. doxx.net combines DNS filtering, encrypted DNS and DNS leak protection. Personalized encrypted DNS filters lookups for devices without routing their other traffic through a tunnel. Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Smart Blocking - doxx.net URL: https://www.doxx.net/help/features/security/smart-blocking/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpSmart Blocking Features> Security – DNS> Smart Blocking Smart Blocking Smart Blocking filters malware, phishing, ads and trackers at the domain level by combining threat lists with an AI classifier that looks for threat patterns. September 30, 2026 Jump to a section Features Common questions Choose filtering categories and add allow or block rules for each tunnel. 1.Features Filter malicious, phishing, advertising, tracking, and content domains. Choose categories for the protection you want. Review blocked requests and the reasons behind them. To configure Smart Blocking settings and learn more navigate in the app to: Account → Settings ⚙ → DNS and Domains → Smart Blocking. 2.Common questions Can I allow a site that was blocked? You can add an allow rule for a domain you trust. Check the blocked domain first: a page can rely on several domains, and you don't want to allow something unrelated. Can different devices have different filters? Yes. Filtering is set per tunnel, so each device's tunnel can have its own settings. Will this remove every ad inside every app? No. Smart Blocking works at the domain level. It isn't a tool for removing individual elements from a page or guaranteeing an ad-free experience everywhere. Does it replace being careful with downloads and links? No. Filtering reduces unwanted connections, but no threat list or classifier catches everything. Keep your devices updated and be careful with unfamiliar files and links. On this page Features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## DNS Bypass Protection - doxx.net URL: https://www.doxx.net/help/features/security/dns-bypass-protection/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpDNS Bypass Protection Features> Security – DNS> DNS Bypass Protection DNS Bypass Protection Helps keep DNS lookups on your chosen doxx.net resolver on supported connections. September 30, 2026 Jump to a section Features Common questions This works only on supported connections. Use DNS Bypass Protection to help keep supported apps on the doxx.net DNS path. 1.Features Help keep DNS requests on the protected doxx.net path. Prevent supported apps and connections from sidestepping your filtering with a different resolver. Use alongside Smart Blocking so the chosen DNS policy can do its job. To enable and learn more, navigate in the app to: Account → Settings ⚙ → DNS and Domains → DNS Bypass Protection. 2.Common questions Why would an app bypass my chosen DNS? Some browsers and apps use a resolver of their own. That can take their lookups outside the filtering you've configured for the connection. Is DNS Bypass Protection the same as Secure DNS? No. Encrypted DNS protects the lookup in transit. Bypass protection manages which resolver handles it. Does this work on every possible connection? The feature applies to supported connections. Don't assume a DNS setting affects traffic outside the doxx.net connection or every browser and app configuration. On this page Features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Secure DNS - doxx.net URL: https://www.doxx.net/help/features/security/secure-dns/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpSecure DNS Features> Security – DNS> Secure DNS Secure DNS Secure DNS allows you to share your specific doxx.net account DNS settings (DNS over HTTPS (DoH) and DNS over TLS (DoT)), with devices that are not on the doxx.net network through their browser or OS DNS settings. September 30, 2026 Jump to a section Features How to shareBrowser only (Chrome, Edge, Brave) Firefox Android system-wide (Android 9+) iOS and macOS system-wide Windows system-wide Common questions 1.Features Encrypt DNS lookups between your device and doxx.net's resolver. Choose DNS over HTTPS or DNS over TLS. Share DNS configuration with other devices Use personalized encrypted DNS to apply a selected tunnel's filtering policy without sending all other traffic through that tunnel. To share your secure DNS navigate to: Account → Settings ⚙ → DNS and Domains → Share DNS. 2.How to share In the app, copy your DoH URL or DoT hostname. Browser only (Chrome, Edge, Brave) Settings → Privacy & Security → Security → Use secure DNS → Custom → Paste DoH URL Firefox Settings → Privacy & Security → DNS over HTTPS → Max Protection → Custom → Paste DoH URL Works on Windows, macOS, Linux, Android. Protects browser traffic only. Android system-wide (Android 9+) Settings → Network & Internet → Private DNS → Private DNS provider hostname → Paste the DoT hostname Protects all apps and system DNS queries. iOS and macOS system-wide This requires a DNS profile. Use a third-party profile generator like dns.notjakob.com to create a .mobileconfig with your DoH URL, then install via Settings → General → VPN & Device Management. Apple does not provide a simple UI for custom DoH/DoT servers. Windows system-wide Windows Settings DNS is per-adapter and easily bypassed. Use PowerShell (netsh dns add encryption) or a third-party app such as YogaDNS or SimpleDNSCrypt for reliable system-wide protection. The Windows Settings method does not persist system-wide reliably. 3.Common questions Does encrypted DNS encrypt all my internet traffic? No. It protects DNS lookups. The websites and apps you use still need their own secure connections, and a network tunnel serves a separate purpose. Can the resolver still read the lookup? Yes. The resolver has to process the domain name to answer the request. Encryption protects the journey to the resolver; it doesn't hide the request from the resolver itself. Can I use my filtering settings without a full tunnel? Yes. Personalized encrypted DNS links the resolver setup to a tunnel's DNS policy while leaving other device traffic outside that tunnel. Which should I choose, DoH or DoT? Use the option supported by your device or DNS client and follow its setup instructions. Both encrypt the DNS exchange; neither is a replacement for the full network connection. On this page Features How to shareBrowser only (Chrome, Edge, Brave) Firefox Android system-wide (Android 9+) iOS and macOS system-wide Windows system-wide Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Security Insights - doxx.net URL: https://www.doxx.net/help/features/security/network-security/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpSecurity Insights Features> Security – DNS> Security Insights Security Insights See all the trackers and threats blocked from reaching your device. September 30, 2026 Jump to a section Features Common questions 1.Features See blocked activity instead of wondering whether protection is doing anything. Review threat categories and the reasons requests were blocked. Use the information to understand which apps and sites are making unwanted requests. To open the security dashboard, select Security in the app's bottom bar. 2.Common questions What is a blocked threat? A blocked threat just means that doxx.net blocked an unwanted service (either malicious or harmless) such as tracking, ads, malware, or more from reaching your device. What's the difference between Security Insights and Network Insights? Security Insights focuses on blocked trackers and threats. Network Insights shows the health and performance of your connection. What if a site I need is being blocked? Review the blocked domain and your Smart Blocking settings. If you're sure the domain is legitimate, use an allow rule for that domain rather than turning off all filtering. On this page Features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Connectivity and routing help - doxx.net URL: https://www.doxx.net/help/features/connectivity-and-routing/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpConnectivity & Routing Features> Connectivity & Routing Connectivity & Routing Choose where your traffic exits, how you connect and how your tunnel behaves. Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Locations and connection modes - doxx.net URL: https://www.doxx.net/help/features/connectivity-and-routing/locations-and-connection-modes/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpLocations and connection modes Features> Connectivity & Routing> Locations and connection modes Locations and connection modes Choose where your traffic exits and pick a connection mode that fits what you’re doing. September 30, 2026 Jump to a section Locations Connection modes Common questions 1.Locations Choose where your traffic exits the doxx.net network. If you're mainly looking for a responsive connection, sort by Fastest for a starting point. Choose an exit location for your connection. Sort locations by Fastest to find a starting point for a responsive connection. Try another location when your current connection feels slow. To browse and connect to the different locations navigate to: Network → Location (Top navigation bar). 2.Connection modes Connection modes bring a group of settings together so you can choose how you want to connect without configuring every option yourself. Easy Mode: A simplified connection with automatic fast-server selection and DNS filtering. Security: The recommended mode for blocking ads, trackers and malware, with firewall, DNS-bypass and kill-switch protections. Tin Foil Hat: Stronger filtering, Onion Routing and WSS transport. Requires Pro. Some websites may not work. Streaming, Human Rights and Raw modes are coming soon. To browse and connect to the different modes navigate to: Network → Mode (Top navigation bar). 3.Common questions Which location should I choose? If speed is your main concern, start with the Fastest filter. You can also choose a particular location when you want your traffic to exit there. Why is my connection slower than usual? Network congestion can affect it. Try another location and compare how the connection feels. Network Insights can help you check latency and upload and download activity. Which mode should I start with? Easy Mode is a simple starting point if you want automatic fast-server selection. Security is the recommended option if you want the additional protections listed above. Why do some websites stop working in Tin Foil Hat? Its stronger filtering can block things a site relies on. If a site stops working, try a less restrictive mode and check whether filtering is the cause. Do I need Pro for Tin Foil Hat? Yes. Tin Foil Hat requires Pro. Where do I find the Fastest filter? Go to Network → Location → the filter icon next to the location search bar → Search by: Fastest. Choose one of the top locations. What does location actually do? The location determines where your network traffic is routed through. On this page Locations Connection modes Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Encrypted WireGuard Tunnel - doxx.net URL: https://www.doxx.net/help/features/connectivity-and-routing/encrypted-wireguard-tunnel/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpEncrypted WireGuard Tunnel Features> Connectivity & Routing> Encrypted WireGuard Tunnel Encrypted WireGuard Tunnel We use encrypted WireGuard tunnels to secure the traffic between your devices and the doxx.net network. September 30, 2026 Jump to a section Features Common questions WireGuard is the technology behind that connection. The app manages it on supported platforms; Windows and Linux can connect using the standard WireGuard client. 1.Features Encrypt the connection between your device and the doxx.net network. Connect through the doxx.net app on supported platforms or use a standard WireGuard client on Windows and Linux. Use the connection for internet access and permitted services on your private network. To learn more about WireGuard please visit: wireguard.com. In the doxx.net portal, go to My Network → Tunnel List to see tunnel information. 2.Common questions Do I need to install WireGuard separately? No for iOS, macOS and Android: the connection is built into the app. Yes for Windows and Linux: use the standard WireGuard client with your doxx.net configuration. Does a WireGuard connection include Chat, calls and NetDrop? The standard WireGuard client provides the network connection, not the doxx.net app's Comms interface. Can I share my configuration file or QR code? Keep them private. They contain connection credentials. Don't include them in screenshots, public posts or support messages. Can I run another tunnel service at the same time? Use doxx.net on its own. Another tunnel service, including Tailscale, can interfere with the connection. On this page Features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Network Insights - doxx.net URL: https://www.doxx.net/help/features/connectivity-and-routing/network-insights/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpNetwork Insights Features> Connectivity & Routing> Network Insights Network Insights Network Insights shows live connection data including upload and download speeds, latency, connection status, ping, and your connection IP in the “Health” dashboard in the “Network” section on the app. September 30, 2026 Jump to a section Features Common questions 1.Features See live upload and download activity. Check latency and ping to understand how responsive the connection is. See connection status and the IP address in use without leaving the app. To see your network insights on the app navigate to: Network → Health. 2.Common questions What does latency mean? It's the delay in a connection, usually shown in milliseconds. Lower latency generally feels more responsive during calls, games and remote access. Why do the upload and download numbers keep changing? They show activity on the connection. The numbers rise and fall as your apps send and receive data; they aren't a promise of the maximum speed available. Where do I check my connection information? In the health dashboard under Network in the app you can click on Connection Info and see all your connection data including: Your Exit IPv4 and IPv6 addresses and the doxx.net server address. What should I do if the connection feels slow? Check the live readings on the health dashboard, then try a different location using the Fastest filter. If the problem continues, contact support and describe the device and location involved. Keep tokens and configuration files out of screenshots. On this page Features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Port Forwarding - doxx.net URL: https://www.doxx.net/help/features/connectivity-and-routing/port-forwarding/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpPort Forwarding Features> Connectivity & Routing> Port Forwarding Port Forwarding Port Forwarding allows you to expose internal services from your LAN to the network. September 30, 2026 Jump to a section Important Features Common questions Run a service on your own machine and make it reachable through your tunnel. Connect to development servers or any other service you want to access remotely. Port Forwarding is included with Pro. A dedicated IP is a separate add-on on either plan for $10/month, billed monthly. 1.Important With a public dedicated IP, forwarded ports can be reachable from the internet, subject to your firewall and access rules. Without one IPv4 ports are reachable only through the doxx.net network. IPv6 ports are always publicly reachable. Forwarded ports are accessible from the doxx.net network. Pair forwarding with firewall rules and strong authentication to control who can connect, and choose carefully which service you expose on the network. 2.Features Reach a service running on your own machine through its tunnel. Choose the service you want to make reachable, rather than treating the whole device as open. Use firewall rules to control who can connect. To configure and expose services via doxx.net navigate to: Account → Settings ⚙ → Connection Settings → Port Forwarding. 3.Common questions Is this the same as giving every device access to each other? Port forwarding directs incoming internet traffic on a specific port straight to a designated device inside your private home or office network. Private mesh access and firewall rules determine which devices can communicate. Does a dedicated IP automatically open my ports? No. Having an address and allowing access are separate things. You still need the appropriate service configuration and access rules. Why can't I reach my service? Check that the host is connected, the service is running and the intended port is allowed. If the service is private, also check that the device you're connecting from has permission to reach it. On this page Important Features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Dedicated IP (Saved Connections) - doxx.net URL: https://www.doxx.net/help/features/connectivity-and-routing/saved-connection/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpDedicated IP (Saved Connections) Features> Connectivity & Routing> Dedicated IP (Saved Connections) Dedicated IP (Saved Connections) A dedicated public IPv4 address gives you a consistent address that isn't shared with other customers. September 30, 2026 Jump to a section Features To lease a public IP Common questions This is especially useful with public sites that recognize your connection by IP (such as banks, government websites, or services), so that they recognize your traffic arriving from a consistent IP address. The address and the access rules do different jobs. Having a dedicated IP doesn't automatically make your services publicly accessible. 1.Features Reserve a public IPv4 address for your use instead of sharing it with other customers. Keep a consistent address for services that recognize you by IP. Combine the address with access rules when you want to make a service reachable. 2.To lease a public IP On the app, navigate to: Account → Settings ⚙ → Connection Settings → Saved Connections. On the portal, navigate to: My Network → Saved Connections. Select the version (IPv4, IPv6, or both). Select the location. 3.Common questions Does a dedicated IP work when I am connected to every location? No, you will only be routed through your static IP when you are connected to the IP’s location. Will a dedicated IP guarantee that a website accepts my connection? No. A consistent IP can help a site recognize your connection, but each site still applies its own checks and access rules. Does it make my device public? Not by itself. Your firewall rules and service settings still control incoming access. Where can I check the price and availability? A Dedicated IP is an add-on on either plan for $10/month, billed monthly. Review the options shown for your account before leasing an address. On this page Features To lease a public IP Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Firewall - doxx.net URL: https://www.doxx.net/help/features/connectivity-and-routing/firewall/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpFirewall Features> Connectivity & Routing> Firewall Firewall Your firewall controls which connections can reach your device. September 30, 2026 Jump to a section Set up your firewall Additional features Common questions With Firewall Protection enabled, incoming connections are blocked unless you explicitly allow them. With Full Mesh Network enabled, ports are open for all devices on the same account. 1.Set up your firewall On the doxx.net app: Account → Settings ⚙ → Connection Settings → Firewall. On the doxx.net portal: My Network → Tunnel List → (the specific tunnel you want to configure) → Connection → Firewall Enable Firewall Protection. If you want all your devices to communicate with each other, enable Full Mesh Network. In the portal this is under Tunnel Linking (Right above Firewall). To allow a service or site, choose a Quick Preset. For a more specific allowance, select Add Custom Rule. Quick Presets allow incoming connections from anywhere within the address’s scope. Only enable the services you intend to make reachable. 2.Additional features Full Mesh Network: Let your devices communicate over the encrypted network, regardless of which doxx.net server each uses. SSH preset: Allow connections on port 22 for remote terminal access. Web preset: Allow connections on ports 80 and 443 for web services. Ping preset: Allow ICMP requests used to check reachability. Custom rules: Add specific connection allowances. Address display: View and copy your device’s doxx.net IPv4 and IPv6 addresses. 3.Common questions Does Full Mesh Network make my devices public? Full Mesh Network allows your own devices to communicate with each other. It isn’t the same as allowing incoming connections from the public internet. Does allowing a port start the service? No. The application or server using that port still needs to be running on the device. Do IPv4 and IPv6 rules have the same reach? Not for the addresses shown on this screen. The displayed IPv4 address is internal to doxx.net, while the IPv6 address is public. An IPv6 allowance can therefore permit connections from the public internet. Is this the same as Smart Blocking? No. Firewall rules control incoming connections to your device. Smart Blocking filters domain lookups for things such as ads, trackers and malicious sites. On this page Set up your firewall Additional features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Split Tunneling (Routing) - doxx.net URL: https://www.doxx.net/help/features/connectivity-and-routing/routing-split-tunneling/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpSplit Tunneling (Routing) Features> Connectivity & Routing> Split Tunneling (Routing) Split Tunneling (Routing) Routing allows you to decide when to route your traffic through the doxx.net network, and when to temporarily suspend it. September 30, 2026 Jump to a section How to set upiOS and macOS Android Common questions The strictest websites/apps will perform an IP lookup when you try to connect and ban certain IP origins. If none of the Covert Networking settings helped, Routing is the last resort. 1.How to set up iOS and macOS On iOS and macOS, the only routing option is Comms only. It sends your traffic over the public internet but keeps your P2P E2EE Comms connections open. To turn on Routing in the iOS app navigate to: Account → Settings ⚙ → Connection Settings → Routing. Android The doxx.net Android app offers split tunneling. You can decide which apps route through the doxx.net network and which stay on the public internet. To turn on Routing in the Android app navigate to: Account → Settings ⚙ → Connection Settings → Routing. 2.Common questions Which Android apps commonly don't work with doxx.net? Android Auto is the most common. Its maps stop working when it sees traffic from a non-personal IP address. Exclude Android Auto with split tunneling and keep the rest of your traffic protected. On this page How to set upiOS and macOS Android Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## MTU - doxx.net URL: https://www.doxx.net/help/features/connectivity-and-routing/mtu/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpMTU Features> Connectivity & Routing> MTU MTU MTU sets the maximum packet size for your tunnel. Automatic mode adjusts it to your network. October 1, 2026 Jump to a section How to set up Additional features Common questions Different networks leave different amounts of room for those packets. doxx.net automatically adjusts the tunnel’s packet size to account for the network and encryption overhead, helping prevent oversized packets from being dropped and transfers getting stuck. 1.How to set up MTU defaults to Automatic. To review the setting, open Account → Settings ⚙ → Connection Settings → MTU in the app. The screen is titled MTU Management. Select Automatic. This is recommended for almost everyone. Check Current Tunnel MTU to see the value being used. Automatic sizing adjusts again when your network changes. Consider Manual only if the connection still misbehaves, such as on a hotel or corporate network. 2.Additional features Automatic sizing: Match the tunnel’s packet size to the network you’re using. Adapt to network changes: Recalculate the size when the connection changes. Account for encryption overhead: Leave room for the information added around your data. Current MTU display: See the tunnel’s active value and whether it was selected automatically. Manual override: Adjust the value when automatic sizing doesn’t suit a particular network. 3.Common questions Should I change this setting? Usually, no. Leave it on Automatic unless you’re troubleshooting a connection problem or have experience with networking. Why does the MTU change between networks? Different networks add different amounts of overhead. A mobile connection may leave less room for your tunnel’s packets than Wi-Fi does. Should I set mine to 1420? No. We recommend leaving MTU on Automatic. The right value depends on your network; 1420 is one possible setting. Can an incorrect MTU cause downloads to stall? Yes. If packets are too large for the connection, they can be dropped. This can leave larger transfers stuck even when some smaller requests still work. On this page How to set up Additional features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Private networking help - doxx.net URL: https://www.doxx.net/help/features/private-networking-and-services/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpPrivate Networking & Services Features> Private Networking & Services Private Networking & Services Your apps and services should be within your reach, but invisible to everyone you don't want to see. Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Private networking overview - doxx.net URL: https://www.doxx.net/help/features/private-networking-and-services/overview/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpPrivate networking overview Features> Private Networking & Services> Private networking overview Private networking overview Your apps and services should be within your reach, but invisible to everyone you don’t want to see. September 30, 2026 doxx.net lets you connect your devices and agents through a private network, give your services domain names under custom TLDs, and certify them from its own certificate authority. Authorized devices on the doxx.net network can then reach these sites through a private connection. Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## DNS Infrastructure - doxx.net URL: https://www.doxx.net/help/features/private-networking-and-services/dns-infrastructure/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpDNS Infrastructure Features> Private Networking & Services> DNS Infrastructure DNS Infrastructure doxx.net runs its own public recursive DNS, so your lookups go through doxx.net's resolver, not your internet provider's. September 30, 2026 Jump to a section Features Common questions For the full breakdown on the doxx.net DNS infrastructure please visit dev-dns.doxx.net. Anyone can use our public recursive DNS, which resolves doxx.net domains (.doxx, .x and more) plus all standard internet domains. 207.207.200.200 207.207.201.201 Our DNS threat classifier AI runs on doxx.net hardware so no queries leave to an outside service. You can use the public resolver on its own to protect lookups without routing all traffic through doxx.net. 1.Features Resolve both standard internet domains and names in doxx.net's namespace. Use doxx.net's own DNS infrastructure instead of your internet provider's resolver. Use personalized encrypted DNS when you want a tunnel's filtering policy without routing all device traffic through that tunnel. 2.Common questions What does a DNS resolver do? It looks up the address associated with a domain name so your device knows where to connect. It's the step between entering a name and reaching the service behind it. Do I need a tunnel to use the public resolver? No. DNS can be used separately. That protects or filters lookups according to the DNS service you've configured; it doesn't create a full network tunnel. Does resolving a .doxx name give me access to the service? No. Finding its address and having permission to connect are separate things. The service may still require a doxx.net connection and the appropriate access rules. Is entering a resolver IP enough to turn on encrypted DNS? No. Use a DNS over HTTPS or DNS over TLS configuration if you want the DNS exchange encrypted. Just selecting a resolver's IP address doesn't establish either of those protocols. On this page Features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## doxx.net domains - doxx.net URL: https://www.doxx.net/help/features/private-networking-and-services/doxxnet-domains/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpdoxx.net domains Features> Private Networking & Services> doxx.net domains doxx.net domains Use a doxx.net domain to name a service on your network. September 30, 2026 Jump to a section Features To register a domain Common questions Instead of remembering an IP address, use one of our 196 TLDs, including .doxx, .crypto and .x. A doxx.net domain is an add-on on either plan for $1/month, billed monthly. 1.Features Give private services recognizable names instead of relying on IP addresses. Choose a domain in doxx.net's namespace or import one you already own. Manage the DNS records that point a name to your service. Prove ownership of an imported domain with a DNS TXT record. 2.To register a domain In the app, go to Account → Settings ⚙ → DNS and Domains → My Domains. In the web portal, go to DNS and PKI → Register Domains. 3.Common questions Does registering a domain create or host my website? No. The name points to a service; you still need to run that service on a connected machine and configure the relevant DNS and access rules. Is knowing the domain name enough to reach my private service? No. Resolving a name and being allowed to connect are different. Use network and firewall controls to decide who can reach the service. Why won't a .doxx name open in my browser? Check that you are using the doxx.net DNS resolver (see Why can't I reach a .doxx domain?). A browser using a different secure DNS provider may bypass that resolver. Also check that the host is connected and your device is allowed to reach it. On this page Features To register a domain Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Bring Your Own Domain (BYOD) - doxx.net URL: https://www.doxx.net/help/features/private-networking-and-services/bring-your-own-domain-byod/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpBring Your Own Domain (BYOD) Features> Private Networking & Services> Bring Your Own Domain (BYOD) Bring Your Own Domain (BYOD) Import a domain you already own and manage it on doxx.net. September 30, 2026 Jump to a section Import your domain Common questions Already have a domain? Import it and verify ownership with a DNS TXT record. You can use a name you already recognize rather than starting again in a new namespace. Bring Your Own Domain is included with Pro. Your domain stays with your registrar. Importing it doesn't transfer the registration to doxx.net. For the full information on doxx.net domains go to: doxx.net portal → DNS and PKI. 1.Import your domain In the doxx.net portal, go to DNS and PKI → Import Domain. Copy the TXT record in the field. Enter the domain name you want to import. Navigate to your domain hosting service. Add the TXT record in that domain's DNS settings. Sometimes “Host” is also called “Name” and “Value” is called “Content”. Once the record is live click Verify and Import on the doxx.net portal. Update your domain's nameservers at your registrar using the values shown after import. 2.Common questions Does importing my domain move it away from my registrar? No. Your domain registration stays with your registrar. To use doxx.net for authoritative DNS, update your domain's nameservers at your registrar. Where will I be able to manage my domain? You can manage your imported domains in DNS and PKI → Domains, along with your doxx.net-specific domains. All your domains are in one place. On this page Import your domain Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Private PKI and Signed Certificates - doxx.net URL: https://www.doxx.net/help/features/private-networking-and-services/private-pki-and-sign-certificates/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpPrivate PKI and Signed Certificates Features> Private Networking & Services> Private PKI and Signed Certificates Private PKI and Signed Certificates A private service (such as a site or app) still needs a way to prove it's the service you meant to reach. September 30, 2026 Jump to a section Features Install a signed certificate Common questions PKI is the certificate system that makes that trust possible. Verify the identity of your doxx.net services with certificates from doxx.net’s private certificate authority. That lets your private services use authenticated, encrypted connections without relying on a public certificate authority to recognize a .doxx name. 1.Features Verify the identity of services using eligible doxx.net domain names. Use certificates signed by doxx.net's own certificate authority in order to encrypt traffic. Support authenticated HTTPS connections to private services. Keep the service's private key on the machine where it was generated. doxx.net certificates do not apply for external TLDs such as .com and .org. 2.Install a signed certificate Navigate on the portal to: DNS and PKI → Sign Certificate. On the machine that your service/website is hosted on: Generate a CSR key using OpenSSL (The specific command written in the doxx.net portal). Paste the CSR into the doxx.net portal. doxx.net will create your website’s certification. Paste it back into your machine and now you have an official doxx.net signed certificate. Devices that trust the doxx.net root CA will see your site as secure. Access rules still decide who can reach it. Imported public domains need an appropriate public certificate authority instead. If you configured your network agent, you can ask it to do it for you or configure yourself in the doxx.net portal. 3.Common questions What's the difference between PKI and a domain certificate? PKI is the system behind certificate issuance and trust. A domain certificate is an individual credential that helps identify the service you’re connecting to. Which domains can use these certificates? Domains you own within the supported doxx.net namespace. Imported public names such as .com and .org are outside this private certificate authority's signing scope. Will getting a certificate make my service private? No. A certificate helps verify identity and establish a secure connection. Network access rules still decide who can reach the service. Why does my browser still show a warning? The device or browser may not trust the doxx.net root CA yet. A warning can also mean the certificate is expired or doesn't match the name you're visiting. Check the cause instead of bypassing the warning. Can my agent configure the certificate? An authorized network agent can use the documented certificate-signing tools. It also needs the appropriate access to configure the service that will use the certificate. On this page Features Install a signed certificate Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Root CA Certificates - doxx.net URL: https://www.doxx.net/help/features/private-networking-and-services/root-ca-certificates/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpRoot CA Certificates Features> Private Networking & Services> Root CA Certificates Root CA Certificates When you visit a service on the network (and on the internet), your browser needs to identify that the site is who it says it is. September 30, 2026 Jump to a section Features Common questions Installing the doxx.net root CA certificate does this by identifying that the domain certificate from the service you are trying to reach is real. This isn't automatically covered by installing the app or connecting a WireGuard tunnel. Without the root CA certificate, your browser shows a security warning when you reach the service. Install the root CA rather than bypassing it. 1.Features Give a device or application a trusted reference for checking certificates issued by doxx.net's private authority. Use the official installation instructions for the platform you're setting up. Keep certificate trust separate from connecting a tunnel or opening a firewall rule. To install the Root CA Certificate online visit on the doxx.net portal DNS and PKI → Install Root CA and follow the steps in the portal. Or in the app, go to Account → Settings ⚙ → Privacy → Web Privacy and follow the steps there. 2.Common questions Is the root CA certificate the same as my service's certificate? No. The root identifies the certificate authority you trust. Your service presents its own domain certificate, which is checked against that trust. Should I click through a certificate warning? Don't bypass it as the normal setup method. Follow the official root-installation steps and check that the certificate matches the domain and is valid. If you can't explain the warning, stop and ask for help. Does installing the root certificate connect me to the network? No. Certificate trust, DNS resolution and network access are separate. You may still need to connect to doxx.net and have permission to reach the service. Can I install any root certificate someone sends me? Only install a root certificate from an authority you intend to trust, using its official source. Adding a root changes which certificates your device or application will accept. Is this the same as installing my domain certificate on the server? No. The server uses its domain certificate and private key. The connecting device needs to trust the issuer. Those are two different parts of the setup. On this page Features Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## FAQ - doxx.net URL: https://www.doxx.net/help/faq/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpFAQ FAQ Answers to the questions people ask most. How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## How do I get on the network? - doxx.net URL: https://www.doxx.net/help/faq/how-do-i-get-on-the-network/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpHow do I get on the network? FAQ> How do I get on the network? How do I get on the network? To get started, install the app, create your account and connect. September 30, 2026 Jump to a section With the app On Windows or Linux Give yourself a little extra time for downloads, permissions or a Windows/Linux setup. 1.With the app Install doxx.net on iOS, macOS or Android. Create your account and save your token and recovery codes. Choose a location and select Connect. Accept the required connection prompts. When you create an account and add a payment method, you get every Pro feature free for 30 days. 2.On Windows or Linux Install WireGuard, create your account in the web portal and download a tunnel configuration. Import it into WireGuard and activate the connection. See Connect to the network for the full steps. On this page With the app On Windows or Linux Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Why did my internet speed slow down? - doxx.net URL: https://www.doxx.net/help/faq/why-did-my-internet-speed-slow-down/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpWhy did my internet speed slow down? FAQ> Why did my internet speed slow down? Why did my internet speed slow down? A busy network or the location you're using can affect your speed. September 30, 2026 Jump to a section Find a fast location (doxx.net app) If your connection stays slow If things feel slow, try another doxx.net location. 1.Find a fast location (doxx.net app) In the app, open Network → Location. Select the filter icon beside the location search bar. Set Search by: Fastest. Choose one of the top locations and try your connection again. If you are using the doxx.net portal, create a tunnel in a new location. 2.If your connection stays slow Tell us what is going on at the Support page or the doxx.net Discord support channel, and explain which location you tried and what feels slow. If you've customized your connection, check what a mode will change before switching just to test speed. Applying a mode can replace your settings. On this page Find a fast location (doxx.net app) If your connection stays slow Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## How do I know if I am connected? - doxx.net URL: https://www.doxx.net/help/faq/how-do-i-know-if-i-am-connected/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpHow do I know if I am connected? FAQ> How do I know if I am connected? How do I know if I am connected? Check the connection status on the device you're using. September 30, 2026 Jump to a section In the doxx.net app In WireGuard Having the app or portal open doesn't mean you're connected. 1.In the doxx.net app Once you see "you're safe." and the blue toggle in the top right, you’re in. 2.In WireGuard Check that your tunnel is active. Once you've used the connection, the handshake and transfer details can help you check that traffic is getting through. The portal's Connected: Live data label means the dashboard is receiving live updates. Below that, if Aggregate Network Activity is active (download and upload speeds are above 0) for your tunnel, you are connected to the network. Can’t get connected? Go to the Support page, email support@doxx.net, or reach out on the doxx.net Discord support channel with your issue and we will help guide you through your problem. On this page In the doxx.net app In WireGuard Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Why can't I reach a .doxx domain? - doxx.net URL: https://www.doxx.net/help/faq/why-cant-i-reach-a-doxx-domain/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpWhy can't I reach a .doxx domain? FAQ> Why can't I reach a .doxx domain? Why can't I reach a .doxx domain? If a .doxx address won't open, first check that you're connected to doxx.net. September 30, 2026 Jump to a section Check Chrome on a computer Still not working? Chrome's DNS setting can also get in the way of looking up the address. 1.Check Chrome on a computer While connected to doxx.net: Open chrome://settings/. Go to Privacy and security → Security. Turn off Use secure DNS. Try the address again. This changes Chrome's DNS lookup setting. Do not turn off Safe Browsing or HTTPS protection. If you later use a different network or resolver, review your DNS setting again. See Chrome's DNS settings help for the browser control. 2.Still not working? Contact support@doxx.net with the address and the error you see. If you see a certificate warning, don't bypass it to force the page open. On this page Check Chrome on a computer Still not working? Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## What should I do if I lose my token? - doxx.net URL: https://www.doxx.net/help/faq/what-should-i-do-if-i-lose-my-token/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpWhat should I do if I lose my token? FAQ> What should I do if I lose my token? What should I do if I lose my token? Use a saved recovery code to sign in and get a new token. September 30, 2026 Jump to a section Recover with a code No token or recovery codes? Use one to get back into your account and get a new token. 1.Recover with a code On the sign-in screen, select Forgot Token? Recover account below the token field. Enter one of your saved recovery codes. When recovery signs you in, open Account. Copy your new token and replace the old one in your password manager. Recovery replaces your sign-in credential. If another device asks you to sign in again, use the new token. 2.No token or recovery codes? Email support@doxx.net for help with the next steps. We can't guarantee that we'll be able to restore access. On this page Recover with a code No token or recovery codes? Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Why won’t doxx.net connect on some Wi-Fi networks? - doxx.net URL: https://www.doxx.net/help/faq/why-is-doxx-net-not-connecting-on-certain-wifi-networks/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpWhy won’t doxx.net connect on some Wi-Fi networks? FAQ> Why won’t doxx.net connect on some Wi-Fi networks? Why won’t doxx.net connect on some Wi-Fi networks? Complete the network’s sign-in steps, then try Covert Networking if the connection is still blocked. October 1, 2026 Hotel, airport and café Wi-Fi networks may require you to sign in before connecting. Complete the network’s portal steps, such as entering an email address or accepting its terms, then try connecting to doxx.net. doxx.net does not bypass these portals. Some networks also restrict tunnel traffic. If you still can’t connect, try Covert Networking. Using Covert Networking If a network doesn’t allow connections through doxx.net, try changing the Covert Networking settings to one of the following: Protocols: ICMP Echo (Ping Requests and Reply Tunneling). Its lower bandwidth capacity may reduce connection speed. Cloudflare WSS (TCP 443, CDN-proxied WebSocket) UDP port selection: 51820 (the default) 53 (DNS) 443 (HTTPS) 123 (NTP) 5353 Limitations Some networks block all tunnel traffic. If these options don’t work, doxx.net may be unable to connect on that network. Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## How do I reach customer support? - doxx.net URL: https://www.doxx.net/help/faq/how-do-i-reach-customer-support/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpHow do I reach customer support? FAQ> How do I reach customer support? How do I reach customer support? Email support@doxx.net, or use the doxx.net Discord support channel. September 30, 2026 Jump to a section What to include in your support request Keep credentials private Go to the Support page, email support@doxx.net, or use the doxx.net Discord support channel. 1.What to include in your support request Tell us what you were trying to do, what happened and which device or operating system you're using. Include the error message or a screenshot if it helps. Before you send a screenshot, hide any private account information. 2.Keep credentials private Never post your account token, recovery codes, private keys or a tunnel configuration in a public channel. For account-access or billing problems, use the support email rather than a public discussion. On this page What to include in your support request Keep credentials private Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Does doxx.net store any data? - doxx.net URL: https://www.doxx.net/help/faq/does-doxx-net-store-any-data/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpDoes doxx.net store any data? FAQ> Does doxx.net store any data? Does doxx.net store any data? doxx.net keeps account records but no network activity logs. September 30, 2026 Jump to a section What is kept? What about my network/browser activity? doxx.net needs some records to run your account and save its settings. That's separate from logging what you do on the network. 1.What is kept? The privacy policy describes account credentials, tunnel configuration, preferences, subscription information and domain ownership records. Optional recovery details such as an email and a phone number are kept if you supply them. 2.What about my network/browser activity? doxx.net has a strict no-logs policy built into its network. We keep no history of your network, browsing or communication activity. Some opt-in dashboard data, such as recently blocked threats, is held briefly in memory. Read our privacy policy for the full privacy scope and retention details. On this page What is kept? What about my network/browser activity? Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Can I use doxx.net and Tailscale together? - doxx.net URL: https://www.doxx.net/help/faq/can-i-connect-to-doxx-net-and-tailscale-at-the-same-time/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpCan I use doxx.net and Tailscale (or a similar service) at the same time? FAQ> Can I use doxx.net and Tailscale (or a similar service) at the same time? Can I use doxx.net and Tailscale (or a similar service) at the same time? No, doxx.net must be used on its own. September 30, 2026 Any other active tunnel service, including Tailscale, will interfere with the connection. Disconnect the other service before connecting to doxx.net. If you need the other service again, disconnect doxx.net before switching back. Working with another VPN? We can help you migrate. Contact us on the doxx.net Discord support channel and tell us what setup you’re running and we will help bring you over to the doxx.net network. Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## How do I choose a connection mode? - doxx.net URL: https://www.doxx.net/help/faq/how-do-i-choose-a-connection-mode/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpHow do I choose a connection mode? FAQ> How do I choose a connection mode? How do I choose a connection mode? Choose the mode that matches how much filtering and privacy protection you want. September 30, 2026 Jump to a section Available connection modes Before switching modes 1.Available connection modes Easy Mode: A simplified connection with automatic fast-server selection and DNS filtering. Security: The recommended mode for blocking ads, trackers and malware, with firewall, DNS-bypass and kill-switch protections. Tin Foil Hat: Stronger filtering, Onion Routing and WSS transport. Requires Pro. Some websites may not work. 2.Before switching modes Switching modes can replace your custom settings. If you use a saved profile or dedicated IP, check what will change before you switch. Streaming, Human Rights and Raw modes are coming soon. For more information please see Locations and Connection modes. On this page Available connection modes Before switching modes Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Sharing a seat vs. inviting a friend - doxx.net URL: https://www.doxx.net/help/faq/whats-the-difference-between-sharing-a-seat-and-inviting-a-friend/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpWhat's the difference between sharing a seat and inviting a friend? FAQ> What's the difference between sharing a seat and inviting a friend? What's the difference between sharing a seat and inviting a friend? Invite a friend to chat and share files. Share a seat to give them access from your plan. September 30, 2026 Invite a friend when you want to chat, call or share files. Share a seat when you want them to use access from your plan. Invite a friend Use Comms → + to exchange a link or QR code. Once paired, you can use the available chat, calling and file-sharing features together. Share a seat Use Account → Plan sharing → Share a seat to invite someone onto your plan. Adding a friend doesn't automatically give them a paid seat. Sharing a seat doesn't give them permission to access all your private services either. See Share seats for the steps and plan note. Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Should I keep my WireGuard configuration private? - doxx.net URL: https://www.doxx.net/help/faq/should-i-keep-my-wireguard-configuration-private/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpShould I keep my WireGuard configuration private? FAQ> Should I keep my WireGuard configuration private? Should I keep my WireGuard configuration private? Your configuration file contains your private key, so keep it as private as your login details. September 30, 2026 It isn't just a settings file. Use it only on the device it was created for. Do not post it in a support channel, paste it into an untrusted tool or share its configuration QR code. Use the invitation or seat-sharing controls when you want to help someone else join doxx.net. Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Why can't I reconnect after pausing my subscription? - doxx.net URL: https://www.doxx.net/help/faq/why-cant-i-reconnect-after-pausing-my-subscription/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpWhy can't I reconnect after pausing my subscription? FAQ> Why can't I reconnect after pausing my subscription? Why can't I reconnect after pausing my subscription? While your subscription is paused, you can't create new tunnels or reconnect. September 30, 2026 While your subscription is paused, you can't create new tunnels or reconnect. You'll see Paused and a note that you can't create tunnels or reconnect until you reactivate. Open the subscription page and select Reactivate. This restarts your subscription and billing, so read any confirmation before you continue. See Pause or cancel your subscription for the difference between pausing and cancelling. Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Account and Device - doxx.net URL: https://www.doxx.net/help/account-and-device/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpAccount and Device Account and Device Sign in, delete your account and share seats. Sign in to doxx.net Delete your account Share seats Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Sign in to doxx.net - doxx.net URL: https://www.doxx.net/help/account-and-device/log-in-to-doxx-net/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpSign in to doxx.net Account and Device> Sign in to doxx.net Sign in to doxx.net Sign in to doxx.net with your account token. September 30, 2026 Jump to a section Sign in with your token Find your token while signed in If you lose your token Sign in with your token. 1.Sign in with your token Open the doxx.net app. Select Already have an account? Login with your token at the bottom of the screen. Enter the token from your password manager or the secure place where you saved it. Keep your token private. 2.Find your token while signed in If you didn't save your token in a password manager, find it in the app under Account → Your Token. 3.If you lose your token Use one of your saved recovery codes to get back into your account. If you've lost both your token and recovery codes, contact support@doxx.net. On this page Sign in with your token Find your token while signed in If you lose your token Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Delete your account - doxx.net URL: https://www.doxx.net/help/account-and-device/delete-your-account/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpDelete your account Account and Device> Delete your account Delete your account Deleting your account permanently removes it from doxx.net, including its linked devices, saved configuration and subscription data. September 30, 2026 Jump to a section Before you delete your account Delete your account Before you continue, make sure you're ready to lose access to the account and its data. 1.Before you delete your account Save any information or invoices you want to keep. Active connections will end, and linked devices will lose the deleted account's access. If your subscription is billed through Apple, cancel it with Apple separately. Deleting your doxx.net account does not cancel that subscription. Follow Apple's cancellation instructions. For other billing preparation, see Before you delete your account: billing. 2.Delete your account Open Account. Select Delete Account. Read the warnings, including the Apple subscription warning, and follow the deletion confirmation. You can't undo account deletion. Signing out or uninstalling the app doesn't delete your account. On this page Before you delete your account Delete your account Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Share seats - doxx.net URL: https://www.doxx.net/help/account-and-device/share-seats/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpShare seats Account and Device> Share seats Share seats Want to share your plan with another person or device? September 30, 2026 Jump to a section Send a seat invitation Accept a seat invitation Give your agent a seatCheck your account Give it dedicated access Agent Gateway Seat availability by plan Removing a seat Add a device to your network by sending a seat invitation. 1.Send a seat invitation Open Account. Go to Plan sharing → Share a seat. Send the invitation link or show the QR code to the recipient. 2.Accept a seat invitation Scan the QR code or open the link on the relevant device, then follow the app's setup steps. You'll join the setup flow after the token step. You can use this route to add more of your own devices as well. 3.Give your agent a seat To add a seat with AI and/or give your agent a seat, first give your agent the doxx.net skill. Follow the setup instructions for your AI provider at github.com/doxxcorp/doxx-skills. Check your account You’ll need a doxx.net account and a subscription that supports your desired setup. Once you install the skill, have your agent read config.doxx.net and explain the setup for whatever environment your agent is running on. Give it dedicated access Create a separate, expiring token with the permissions needed for the task. Configure your token according to the role you want for your agent. Store the token securely. Don’t paste it into the conversation or share your main account token. For more information on agent roles and to generate your agent’s token, go to the doxx.net online portal and navigate to: Account → Auth Tokens → New Token. Review the plan → configure the connection Review the agent's plan before it changes anything. Afterward, ask it to test the connection and summarize what changed. Agent Gateway Chatting and exchanging files with your agent through Comms is an additional setup. Ask your agent to include doxxGateway setup in its network configuration. For full instructions please refer to github.com/doxxcorp/doxx-skills. 4.Seat availability by plan Device seats and agent seats are counted separately: Essential: 2 device seats and 1 agent seat. Pro: 5 device seats and 5 agent seats. Add another device or agent to either plan for $1/month each. Add-ons are billed monthly, even on a yearly plan. 5.Removing a seat To remove a seat from your account in the app: Open Account. Go to Devices. Select ··· next to the device you want to remove. Select Remove from subscription. For help with an existing seat, contact support@doxx.net. On this page Send a seat invitation Accept a seat invitation Give your agent a seatCheck your account Give it dedicated access Agent Gateway Seat availability by plan Removing a seat Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Billing - doxx.net URL: https://www.doxx.net/help/billing/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpBilling Billing Plans, payment details, invoices, pausing and cancelling. Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Plans (and what's included) - doxx.net URL: https://www.doxx.net/help/billing/plans-and-whats-included/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpPlans (and what's included) Billing> Plans (and what's included) Plans (and what's included) Compare Essential and Pro, including prices, device seats, agent seats and monthly add-ons. September 30, 2026 Jump to a section Plans Essential: Private browsing and threat protection Pro: Run agents and private services Plan comparison Where to find your plan Common questions 1.Plans Plan Monthly price Annual price Device seats Agent seats Essential $6 $60 2 1 Pro $16 $160 5 5 Pay yearly and get 2 months free. 2.Essential: Private browsing and threat protection Get private browsing, DNS protection and P2P E2EE Comms for your devices. Essential includes 2 device seats and 1 agent seat. 3.Pro: Run agents and private services Pro includes 5 device seats and 5 agent seats. It adds agent tools, Covert Networking, Onion Routing, Port Forwarding and private networking to the features in Essential. 4.Plan comparison Essential Pro Add-ons Device seats 2 5 Agent seats 1 5 Additional Device or Agent Add-on Add-on $1/month P2P NetDrop Yes Yes P2P Chat Yes Yes P2P Voice Call Yes Yes P2P Video Call Yes Yes Agentic Network Management No Yes Agent Gateway No Yes Agent Identity No Yes MCP & API No Yes Covert Networking No Yes Onion Routing No Yes Web Privacy Yes Yes Network Fingerprint Yes Yes Self-Destruct PIN Yes Yes Smart Blocking Yes Yes DNS Bypass Protection Yes Yes Secure DNS Yes Yes Security Insights Yes Yes Native IPv6 Yes Yes Firewall Yes Yes Connection Auto-Tuning Yes Yes Dedicated IP Add-on Add-on $10/month Port Forwarding No Yes Network Insights Yes Yes Kill Switch Yes Yes doxx.net domain Add-on Add-on $1/month Bring Your Own Domain No Yes DNS Infrastructure No Yes Private PKI No Yes Split Tunneling Yes Yes Add-ons are available on both plans and billed monthly, even if you pay for your plan yearly. See the pricing page for the full plan comparison. 5.Where to find your plan App: Account → Network Platform opens the doxx.net portal. Then go to Account → Subscriptions. Portal: Account → Subscriptions 6.Common questions Which plan includes calls, chat and file sharing? Both plans include calls, chat and file sharing. Which plan includes Agent Gateway? Pro includes Agent Gateway, MCP & API and Agentic Network Management. The plan comparison above lists the included features and the separate device and agent seat counts. Can I add more device or agent seats? Yes. Add a device or agent to either plan for $1/month each. Add-ons are billed monthly, even on a yearly plan. Is a dedicated IPv4 address included with Pro? No. It's an add-on on both plans for $10/month, billed monthly. Can I bring a domain I already own? Yes. Bring Your Own Domain is included with Pro. On this page Plans Essential: Private browsing and threat protection Pro: Run agents and private services Plan comparison Where to find your plan Common questions Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Manage your plan, payment details and add-ons - doxx.net URL: https://www.doxx.net/help/billing/manage-your-plan-payment-details-and-add-ons/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpManage your plan, payment details and add-ons Billing> Manage your plan, payment details and add-ons Manage your plan, payment details and add-ons You can manage your plan, payment method and add-ons from your subscription page. September 30, 2026 Jump to a section Open your subscription page Change your plan Update your payment details Add or remove add-ons Choose the option for what you want to change. 1.Open your subscription page Sign in to the doxx.net web portal, then open Account → Subscriptions. You'll see your current plan and the changes you can make. 2.Change your plan Select Change Plan. Check Plans and what's included to compare the device seats, agent seats and features in each plan. 3.Update your payment details Select Update Payment. 4.Add or remove add-ons Select Add-ons to reach the controls for additional devices or agents, dedicated IPs and doxx.net domains. On this page Open your subscription page Change your plan Update your payment details Add or remove add-ons Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Find your invoices - doxx.net URL: https://www.doxx.net/help/billing/find-your-invoices/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpFind your invoices Billing> Find your invoices Find your invoices If you pay directly through Stripe, you'll find the Invoices option on your doxx.net subscription page. September 30, 2026 Jump to a section Find your invoices If an invoice is missing Before you delete your account 1.Find your invoices Sign in to the web portal. Open Account → Subscriptions. Select Invoices. Click on the invoice you would like to view and a pdf will be downloaded to your computer/phone where you can see your receipt. 2.If an invoice is missing Contact support@doxx.net for help with a direct subscription. Do not post billing documents in a public Discord channel. If Apple bills your subscription, check your purchase records with Apple instead. 3.Before you delete your account Download any invoices you want to keep before deleting your doxx.net account. See Delete your account for the billing precautions. On this page Find your invoices If an invoice is missing Before you delete your account Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Pause or cancel your subscription - doxx.net URL: https://www.doxx.net/help/billing/pause-or-cancel-your-subscription/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpPause or cancel your subscription Billing> Pause or cancel your subscription Pause or cancel your subscription Pausing lets you stop subscription billing and reactivate later. October 1, 2026 Jump to a section Pause a direct subscription Reactivate your subscription Cancel a direct subscription Deleting your account Cancelling and pausing are different actions. Pausing stops billing and keeps your account ready to reactivate. Cancelling ends the subscription. 1.Pause a direct subscription Open the web portal. Go to Account → Subscriptions. Select Pause Subscription and follow the confirmation shown. You won't be charged while your plan is paused, but you can't create new tunnels or reconnect. You'll see Paused and a note that you can't create tunnels or reconnect until you reactivate. 2.Reactivate your subscription Ready to return? Select Reactivate on your subscription page to restart your subscription and billing. Read the confirmation before you continue. 3.Cancel a direct subscription Open Account → Subscriptions → Cancel Subscription. 4.Deleting your account Cancelling a subscription and deleting an account are separate actions. See Delete your account if you also want to remove the account. On this page Pause a direct subscription Reactivate your subscription Cancel a direct subscription Deleting your account Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp. --- ## Before you delete your account: billing - doxx.net URL: https://www.doxx.net/help/billing/delete-your-account/ Product Resources Pricing Get Started Overview What is doxx.net? Why doxx.net? What is an Agentic Defined Network? Zero Network Logging Quick Start Download and install Create your account Connect to the network Share the network Features Agentic Defined Networking Agentic Defined Networking overview Setting up with AI API and MCP Agent Gateway Webhooks Privacy Privacy overview Covert Networking Onion Routing Web Privacy Self-Destruct PIN P2P E2EE Comms P2P E2EE Comms overview Chat Call and Video NetDrop Security – DNS Security overview Smart Blocking DNS Bypass Protection Secure DNS Security Insights Connectivity & Routing Locations and connection modes Encrypted WireGuard Tunnel Network Insights Port Forwarding Dedicated IP (Saved Connections) Firewall Split Tunneling (Routing) MTU Private Networking & Services Private networking overview DNS Infrastructure doxx.net domains Bring Your Own Domain (BYOD) Private PKI and Signed Certificates Root CA Certificates FAQ How do I get on the network? Why did my internet speed slow down? How do I know if I am connected? Why can't I reach a .doxx domain? What should I do if I lose my token? Why won’t doxx.net connect on some Wi-Fi networks? How do I reach customer support? Does doxx.net store any data? Can I use doxx.net and Tailscale (or a similar service) at the same time? How do I choose a connection mode? What's the difference between sharing a seat and inviting a friend? Should I keep my WireGuard configuration private? Why can't I reconnect after pausing my subscription? Account and Device Sign in to doxx.net Delete your account Share seats Billing Plans (and what's included) Manage your plan, payment details and add-ons Find your invoices Pause or cancel your subscription Before you delete your account: billing Browse helpBefore you delete your account: billing Billing> Before you delete your account: billing Before you delete your account: billing Save your invoices and cancel the relevant subscription before you delete your doxx.net account. September 30, 2026 Jump to a section Before you delete your account Questions about previous charges Before you delete your account, save the billing records you need and cancel the relevant subscription. 1.Before you delete your account Download any invoices you want to keep from Account → Subscriptions → Invoices. For a direct subscription, use Account → Subscriptions → Cancel Subscription before deleting the account. If Apple bills your subscription, you must cancel it with Apple. Account deletion does not do this for you. Use Apple's cancellation guide. 2.Questions about previous charges Contact support@doxx.net before deleting if you need help with an invoice or a charge. Deleting your account doesn't request a refund. For the deletion steps, see Delete your account. On this page Before you delete your account Questions about previous charges Built on owned infrastructure. Product All Features Pricing Download Resources Blog Insights Help Center DNS Infrastructure About doxx.net Company Community Support Legal Privacy Policy Terms of Service © 2026 doxx.net Corp.