DNS Over HTTPS

Today, I decided to document my DNS resolver configuration.

Since 2 years ago, I’ve been moving to DNS over HTTPS configuation as my resolver whenever possible. This including my handphone.

I’ll also compare DoH with DNSSEC, as there is many misunderstanding about it.

My DoH Config

#

This is the list of DNS providers that I use normally.

Public DoH

#

Here are the popular public DoH Server URLs:

• Cloudflare: https://1.1.1.1/dns-query (Backup: https://1.0.0.1/dns-query)
• Google Public DNS: https://dns.google/dns-query
• Quad9: https://dns.quad9.net/dns-query
• AdGuard: https://dns.adguard.com/dns-query (Family protection: https://dns-family.adguard.com/dns-query)
• OpenDNS: https://dns.opendns.com/dns-query

DNS Resolver

#

There are several methods we can setup DNS resolver.

1. DNS over UDP: Using 53/udp.
2. DNS over TCP: Using 53/tcp. Fallback mode when UDP response is too large.
3. DNS over TLS/SSL (DoT): 853/tcp
4. DNS over HTTPS (DoH): 443/tcp
5. DNS over HTTP/3: 443/udp. DoH carried over HTTP/3/QUIC.
6. DNS over QUIC (DoQ): 853/udp. DNS directly over QUIC.

DNSSEC

#

DNSSEC is not a DNS transport method like others.

DNSSEC uses cryptographic signatures for validation. This allows a resolver to determine whether a DNS response is authentic and has not been modified. It does not hide the DNS query from someone observing the network.

Here’s the quick comparison.

Links

#

• Public DoH Servers