Classic DNS queries travel unencrypted over UDP port 53. Anyone on the path, such as an ISP, a Wi-Fi operator or a compromised router, can see which domains you look up, and in some cases tamper with the answers. DNS over TLS (DoT) and DNS over HTTPS (DoH) encrypt those queries between your machine and the resolver. Here’s how they differ, and how to enable them on a Linux server or self-hosted resolver.

DoT vs DoH vs plain DNS

Plain DNS DNS over TLS (DoT) DNS over HTTPS (DoH)
Transport UDP/TCP 53 TLS on TCP 853 HTTPS on TCP 443 (and HTTP/3)
Encrypted No Yes Yes
Easy to block or identify — Yes (dedicated port) Hard (looks like web traffic)
Typical users Everything OS resolvers, Android “Private DNS”, routers Browsers, apps, some OS resolvers

Both protect the query path to the resolver. The resolver itself still sees your queries, so pick one you trust, or run your own. DNSSEC is a separate mechanism that protects authenticity of answers, and complements encryption.

DoT on a server: systemd-resolved

Ubuntu and many other distributions use systemd-resolved. Enable DNS over TLS in /etc/systemd/resolved.conf:

[Resolve]
DNS=1.1.1.1#cloudflare-dns.com 9.9.9.9#dns.quad9.net
FallbackDNS=
DNSOverTLS=yes
DNSSEC=allow-downgrade
  • The #hostname part is used to verify the resolver’s TLS certificate.
  • DNSOverTLS=yes is strict: if TLS fails, resolution fails. opportunistic tries TLS, and falls back to plain DNS.
sudo systemctl restart systemd-resolved
resolvectl status | grep -E 'DNS Servers|DNSOverTLS'
resolvectl query example.com

Verify encryption with a packet capture. You should see traffic to port 853, and none on 53 leaving the server:

sudo tcpdump -i eth0 -nn 'port 53 or port 853' -c 20

See change DNS servers on Linux and tcpdump.

Note: some server software bypasses the system resolver by querying configured DNS servers directly. Check those configs too: Postfix with its own resolver, or apps with hard-coded DNS.

DoH on a server: a local proxy

systemd-resolved doesn’t speak DoH. Use a small local proxy that accepts plain DNS on localhost and forwards over HTTPS. dnscrypt-proxy and cloudflared are common choices:

sudo apt install dnscrypt-proxy

/etc/dnscrypt-proxy/dnscrypt-proxy.toml:

listen_addresses = ['127.0.0.1:5353']
server_names = ['cloudflare', 'quad9-doh-ip4-port443-filter-pri']
doh_servers = true
require_dnssec = true

Point systemd-resolved or your resolver at 127.0.0.1:5353. That keeps all queries encrypted with DoH.

For your whole network: encrypt upstream on a self-hosted resolver

If you run Pi-hole, AdGuard Home or Unbound on a VPS or at home, clients talk to it with plain DNS (ideally over a private network or VPN), and it forwards upstream encrypted:

  • AdGuard Home supports DoH, DoT and DoQ upstreams natively, and can also serve DoH/DoT to clients (phones’ Private DNS). See AdGuard Home.
  • Unbound can forward over TLS:
forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 1.1.1.1@853#cloudflare-dns.com
    forward-addr: 9.9.9.9@853#dns.quad9.net

Or resolve recursively itself, without a third-party resolver. See Unbound DNS resolver.

  • Pi-hole pairs with Unbound or a DoH proxy for encrypted upstreams. See Pi-hole.

Don’t run an open resolver. A DNS server on a public IP that answers anyone gets abused for amplification attacks. Restrict it by firewall to your IPs or VPN. See DDoS attack types.

Choosing a public encrypted resolver

Resolver DoT host DoH URL Notes
Cloudflare one.one.one.one / cloudflare-dns.com https://cloudflare-dns.com/dns-query Fast, privacy commitments
Quad9 dns.quad9.net https://dns.quad9.net/dns-query Blocks known malicious domains
Google dns.google https://dns.google/dns-query Widely available
Mullvad, NextDNS, AdGuard DNS various various Filtering and privacy options

Trade-offs

  • Privacy shifts, it doesn’t disappear: the resolver operator sees your queries. A self-hosted recursive resolver (Unbound) avoids a single third party, but then authoritative servers see your server’s IP.
  • Corporate and parental controls relying on DNS filtering are bypassed by DoH in browsers, which is why some networks block known DoH endpoints.
  • Slight latency for the first TLS connection. After that, reused connections are fast.
  • The SNI still reveals the hostname when you connect to the website itself, unless Encrypted ClientHello is used. See SSL/TLS explained.

Quick reference

Task Command / setting
DoT in systemd-resolved DNSOverTLS=yes + DNS=IP#hostname
Check resolvectl status
DoH proxy dnscrypt-proxy or cloudflared on localhost
Unbound DoT upstream forward-tls-upstream: yes
Verify tcpdump port 53 or port 853

Related: dig and DNS propagation.

  • DNS
  • Privacy
  • Security