Skip to content

Encrypted DNS

DNSao can forward queries to upstream resolvers using encrypted DNS protocols. This is useful when you want devices on your LAN to use a local DNS server while DNSao uses a private upstream transport.

The Problem

Traditional DNS usually uses UDP or TCP on port 53. That traffic is not encrypted. Anyone between DNSao and the upstream resolver, such as an ISP, network operator, or hostile network, may be able to observe which domains are being queried.

Encrypted DNS does not make DNS anonymous, but it reduces passive sniffing between DNSao and the upstream resolver.

What DoT Is

DNS-over-TLS, or DoT, sends DNS queries through a TLS connection, usually on port 853.

In DNSao config, DoT upstreams use:

  • protocol: "dot"
  • ip
  • port: 853
  • tlsAuthName

Example:

resolver:
  upstreams:
    - ip: "1.1.1.1"
      port: 853
      protocol: "dot"
      tlsAuthName: "cloudflare-dns.com"

tlsAuthName is the expected TLS name for the upstream resolver. DNSao uses it to validate that the TLS connection is talking to the intended resolver.

What DoH Is

DNS-over-HTTPS, or DoH, sends DNS queries through HTTPS, usually on port 443.

In DNSao config, DoH upstreams use:

  • protocol: "doh"
  • host
  • port: 443
  • path: "/dns-query"

Example:

resolver:
  upstreams:
    - host: "dns.quad9.net"
      port: 443
      protocol: "doh"
      path: "/dns-query"

Why It Matters

Encrypted upstream DNS helps prevent passive sniffing of DNS queries between DNSao and the upstream resolver.

It is useful when:

  • Your ISP or network operator can observe DNS traffic.
  • DNSao runs on a network you do not fully trust.
  • You want clients on your LAN to use local DNS while DNSao uses private upstream transport.
  • You want one place to enforce upstream DNS privacy behavior.

What It Does Not Solve

Encrypted DNS does not make browsing fully anonymous.

Important limitations:

  • The upstream resolver can still see the queries it receives.
  • The client-to-DNSao path is usually local UDP/TCP DNS unless you configure clients to use DoH through DNSao or protect the LAN separately.
  • Domains may still be inferred through SNI, IP addresses, HTTP traffic, or other metadata.
  • Blocklists, local rules, logs, and dashboard data still exist inside DNSao, so protect the dashboard and configuration accordingly.

DoT vs DoH

Protocol Good Fit Trade-Off
DoT Clear DNS-specific encrypted transport; easy to reason about and usually uses port 853 Port 853 may be blocked on some networks
DoH Uses HTTPS over port 443 and often works where DoT is blocked Blends DNS with web traffic and can be harder to inspect or debug

For privacy-focused setups, prefer encrypted upstreams and keep resolver.multiplier at 1:

misc:
  queryLog: false
  dnssec: simple

resolver:
  multiplier: 1
  upstreams:
    - ip: "1.1.1.1"
      port: 853
      protocol: "dot"
      tlsAuthName: "cloudflare-dns.com"
    - ip: "9.9.9.9"
      port: 853
      protocol: "dot"
      tlsAuthName: "dns.quad9.net"

Use resolver.multiplier: 1 when privacy is the main goal. Higher values can improve latency by racing upstreams, but more upstream resolvers will see each query.