Learning DNS - Encrypted DNS: DoT, DoH & DoQ

#Introduction

Ordinary DNS queries can be read and modified by anyone on the network path — access providers, hotspots, or attackers. Encrypted DNS encrypts the whole exchange so no third party can spy on or poison answers. It's the last layer of modern DNS security.

Episode 15 covers the three encrypted DNS protocols — DoT, DoH, and DoQ — then implements them in dnsdist and configures the Recursor for encrypted outgoing connections.

#Three Encrypted DNS Protocols

#Quick Comparison

All three encrypt DNS with TLS; they differ only in the transport layer:

• DoT (RFC 7858): DNS over TLS, port 853. Direct encryption, easy to recognize.
• DoH (RFC 8484): DNS inside HTTP/2, port 443. Disguises DNS traffic as ordinary HTTPS.
• DoQ/DoH3 (RFC 9250): DNS over QUIC, port 853. Combines TLS 1.3 encryption with low-latency multi-streaming.

kdig +tls +tls-ca /etc/ssl/certs/ca-certificates.crt \
  @1.1.1.1 example.com A

The command above sends a DoT query to Cloudflare with certificate chain verification. The +tls-ca flag makes kdig validate the server's certificate.

#Implementation in dnsdist

#DoT Frontend

dnsdist turns a server into an encrypted endpoint simply by registering a TLS listener:

addTLSLocal:
  - address: 0.0.0.0:853
    certificate: /etc/dnsdist/server.crt
    privateKey: /etc/dnsdist/server.key

addTLSLocal creates a DoT listener on port 853 with the server certificate. All queries arriving through this listener are forwarded to the backend just like ordinary queries.

#DoH Frontend

DoH requires HTTP/2, handled in dnsdist 2.1 by nghttp2. A single listener can serve many endpoints:

addDOHLocal:
  - address: 0.0.0.0:443
    certificate: /etc/dnsdist/server.crt
    privateKey: /etc/dnsdist/server.key
    urls:
      - /dns-query

addDOHLocal provides a DoH endpoint on port 443. Clients use the URL https://dns.example.com/dns-query — exactly the pattern used by the big providers.

#DoQ Frontend

DoQ runs over QUIC. dnsdist 2.1 adds a dedicated listener:

addDoQLocal:
  - address: 0.0.0.0:853
    certificate: /etc/dnsdist/server.crt
    privateKey: /etc/dnsdist/server.key

Note: DoQ and DoT conceptually share port 853, but both can run simultaneously on different addresses or using QUIC's port-sharing support.

#Testing Encrypted Endpoints

#Querying DoH with curl

DoH uses HTTP, so it can be tested with curl using the JSON format providers expose:

curl -s 'https://127.0.0.1/dns-query?name=example.com&type=A' \
  -H 'accept: application/dns-json' -k

#Verifying All Protocols

To test the DoT and DoQ endpoints from the client side:

kdig +tls @127.0.0.1 example.com A
kdig +quic @127.0.0.1 example.com A

kdig +tls uses DoT, kdig +quic uses DoQ. If all three commands (curl DoH, kdig DoT, kdig DoQ) return the same answer, your dnsdist is officially running encrypted DNS.

#The Recursor as a Client: Outgoing Encryption

#Encrypted Upstream Connections

Recursor 5.4 can send outgoing queries with encryption. This encrypts the entire chain — from client to upstream — not just the front end:

forward-zones:
  - zone: "."
    addresses:
      - 1.1.1.1:853
      - 9.9.9.9:853
    tls:
      cert: /etc/powerdns/client.pem

#Validating Server Certificates

An important Recursor 5.4 feature: validating upstream server certificates when using DoT. With tls.cert containing trusted CAs, the Recursor refuses connections to servers with invalid certificates — protecting against interception by fake servers.

forward-zones:
  - zone: "."
    addresses:
      - 1.1.1.1:853
    tls:
      cert: /etc/powerdns/ca.pem
      hostname: cloudflare-dns.com

With hostname, the Recursor checks that the server's certificate was indeed issued for that name — the standard TLS protection now applied to outgoing DNS.

#Conclusion

Episode 15 encrypts DNS in all directions: understanding DoT, DoH, and DoQ, providing all three via dnsdist, testing them from the client side, and configuring the Recursor so its outgoing connections are also encrypted and certificate-validated.

Key takeaways:

• DoT uses TLS on port 853, DoH uses HTTP/2 on port 443, DoQ uses QUIC on port 853.
• addTLSLocal creates a DoT endpoint; addDOHLocal for DoH via nghttp2; addDoQLocal for DoQ.
• dnsdist uses a single set of certificates for all three protocols.
• kdig +tls and kdig +quic are quick ways to test endpoints.
• Recursor 5.4 supports outgoing DoT with certificate and hostname validation.

In episode 16, we'll cover DNS security and hardening — threats like Kaminsky-style cache poisoning, spoofing, amplification DDoS, and DNS tunneling, then mitigation with DNS Cookies, rate limiting, dynamic rules, ACLs, 0x20 randomization, random source ports, and Response Policy Zones.