CLI reference#

DoHzel Proxy is controlled from the command line with dohzel-proxy. Use dohzel-proxy <command> --help for subcommand details.

Note: Installation steps for each platform are covered in the Installation guide. This page documents runtime configuration commands.

Global option#

All commands accept:

Runtime settings (mode, enrollment, forwarding rules, cache, and so on) are stored in dynamic.json inside the data directory configured at install time.

Installation and lifecycle#

init#

dohzel-proxy init
dohzel-proxy init /opt/dohzel-proxy
dohzel-proxy init -c https://api.hafnova.com/api -i 9.9.9.9

On Windows, run PowerShell as Administrator. init sets the default mode to DNS2eDOH and fallback DoH to Quad9.

enroll#

dohzel-proxy enroll
dohzel-proxy enroll -n my-proxy
dohzel-proxy enroll -j YOUR_JOIN_TOKEN -n my-proxy

After enrollment, run dohzel-proxy status and note the Rebound URL for web-based management.

status#

Example fields reported by status:

• Rebound URL
• Fallback DoH and initier DNS
• Forwarding mode (DNS2eDOH, DNS2iDOH, or DNS2DNS)
• Local DNS cache state
• Software auto-update state and available updates
• Device management profile (if joined)
• Device name
• Local DNS interception
• DoHzel Connect state
• Listening interface (when configured)

Device and profile#

dohzel-proxy name my-proxy
dohzel-proxy profile join ABC123
dohzel-proxy profile leave

Operating mode and resolvers#

See Operation Modes for a description of each mode.

dohzel-proxy mode DNS2eDOH
dohzel-proxy mode DNS2iDOH
dohzel-proxy fallback https://dns9.quad9.net/dns-query
dohzel-proxy mode DNS2DNS
dohzel-proxy initier 10.0.0.1,10.0.0.2

Mode changes take effect without restarting the service.

Listening interface#

By default the DNS server listens on every interface (IPv4 and IPv6) on port 53. Port 53 requires root or administrator privileges.

The interface command binds the server to a single address and port at runtime. The value is stored in dynamic.json, so you do not need to edit config.js. It takes precedence over the static dns block in config.js.

# IPv4 (defaults to port 53)
dohzel-proxy interface 192.168.1.10

# IPv4 with a custom port
dohzel-proxy interface 192.168.1.10:5353

# IPv6 (use brackets when specifying a port)
dohzel-proxy interface "[2001:db8::1]"
dohzel-proxy interface "[2001:db8::1]:5353"

# Revert to listening on all interfaces
dohzel-proxy interface reset

When a single IPv4 address is selected, only IPv4 sockets are bound (and likewise for IPv6). The current binding is shown by dohzel-proxy status.

Note: Restart the server or service for the change to take effect.

For local development on a non-privileged port, you can alternatively set dns.port in config.js:

module.exports = {
    dataDir: `${process.env.HOME}/.dohzel-proxy`,
    central: "https://api.hafnova.com/api",
    dns: {
        port: 5353,
    },
}

Conditional forwarding#

Manage domain and regex-based forwarding rules. See Conditional Forwarding for examples and output format.

dohzel-proxy forwarding list
dohzel-proxy forwarding create domain mydomain.local 10.10.2.4 -p 1
dohzel-proxy forwarding create regex google 10.10.2.3 -p 2
dohzel-proxy forwarding change 71DE4D -p 100
dohzel-proxy forwarding remove 71DE4D

Note: Forwarding rule changes may require a proxy restart to take effect.

Local DNS interception#

Redirects local DNS traffic through DoHzel. Commonly used on Windows to prevent DNS leaks.

dohzel-proxy intercept set on
dohzel-proxy intercept set off

Check the current state with dohzel-proxy status.

Local DNS cache#

dohzel-proxy cache set on
dohzel-proxy cache set off

DoHzel Connect#

Enable or disable Connect on this proxy host. Console-side rule configuration is described in DoHzel Connect.

dohzel-proxy connect set on
dohzel-proxy connect set off

Auto-update#

Production builds can check for and apply updates automatically. See Updating.

dohzel-proxy update on
dohzel-proxy update off

Use dohzel-proxy status to check whether a newer version is available.

Security checkup#

Test how well a recursive DNS resolver blocks malicious domains using Hafnova CyberIntel samples:

dohzel-proxy checkup 127.0.0.1
dohzel-proxy checkup 192.168.1.1 -c 500 -b 0.0.0.0 -d 250

The command prints a results table and a summary with blocked/passed counts and coverage percentage.

Service management#

Service subcommands depend on the platform. Run dohzel-proxy service --help on the target system.

Linux (systemd)#

Requires root (sudo). Installs the binary to /usr/sbin/dohzel-proxy and registers dohzel-proxy.service.

sudo dohzel-proxy service install
sudo dohzel-proxy service start
sudo dohzel-proxy service stop
sudo dohzel-proxy service restart
sudo dohzel-proxy service uninstall

Windows#

Run PowerShell as Administrator. Installs under C:\Program Files\Hafnova\DoHzel-Proxy\.

dohzel-proxy service install
dohzel-proxy service start
dohzel-proxy service stop
dohzel-proxy service restart
dohzel-proxy service uninstall
dohzel-proxy service update

service update replaces the installed binary with the one you are running (manual upgrade path).

macOS (launchd)#

Requires root (sudo). Registers launch agent com.hafnova.dohzel.proxy and installs the binary to /usr/local/bin/dohzel-proxy.

sudo dohzel-proxy service install
sudo dohzel-proxy service start
sudo dohzel-proxy service stop
sudo dohzel-proxy service restart
sudo dohzel-proxy service uninstall

Related topics#

• Operation Modes
• Conditional Forwarding
• DoHzel Connect
• Updating