How to set DNS over TLS on Linux

This guide uses systemd-resolved, which is available on most modern Linux distributions.

Terminal


sudo systemctl enable --now systemd-resolved

Edit /etc/systemd/resolved.conf:

Terminal


sudo vim /etc/systemd/resolved.conf

Add the following configuration:

/etc/systemd/resolved.conf


[Resolve]
DNS=185.222.222.222 45.11.45.11 2a09:: 2a11::
DNSOverTLS=yes
DNSSEC=yes

Alternatively, you can specify the hostname explicitly:

/etc/systemd/resolved.conf


[Resolve]
DNS=185.222.222.222#dot.sb 45.11.45.11#dot.sb 2a09::#dot.sb 2a11::#dot.sb
DNSOverTLS=yes
DNSSEC=yes

Terminal


sudo systemctl restart systemd-resolved

Edit /etc/resolv.conf:

Terminal


sudo vim /etc/resolv.conf

Set the nameserver to the local resolver:

/etc/resolv.conf


nameserver 127.0.0.53

Test the DNS resolution:

Terminal


dig example.com

You should see a response similar to:

Output


;; ANSWER SECTION:
example.com.		3309	IN	A	93.184.216.34
 
;; SERVER: 127.0.0.53#53(127.0.0.53)

The SERVER: 127.0.0.53#53 in the response confirms that systemd-resolved is handling DNS queries correctly.