Skip to content

DNS encryption (DoT/DoH)

Note

Machine translation from the German version. In case of doubt, the content of the German version shall prevail.

DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH) are protocols for encrypting DNS queries. They are used to protect privacy and enhance security by preventing third parties from reading or manipulating DNS data.

Configuration under Linux with systemd-resolved

On modern Linux distributions, systemd-resolved can be used to implement encrypted DNS queries via DoT.

Check the status of systemd-resolved

First, ensure that the service is active.

systemctl is-active systemd-resolved
The output should read active.

Adjust the configuration file

The configuration is done in the file /etc/systemd/resolved.conf.

Open the file with root permissions (e.g., sudo nano /etc/systemd/resolved.conf) and add or modify the [Resolve] section as follows:

[Resolve]
DNS=134.147.222.4#ns2.ruhr-uni-bochum.de 2a05:3e00:9:1001::222:4#ns2.ruhr-uni-bochum.de
FallbackDNS=134.147.32.40#ns1.ruhr-uni-bochum.de 2a05:3e00:1:1003::32:40#ns1.ruhr-uni-bochum.de
DNSOverTLS=yes
Domains=ruhr-uni-bochum.de ~.
Cache=no-negative
DNSSEC=yes

Restart service 3.

Restart the service to load the new configuration.

sudo systemctl restart systemd-resolved

Verify DNS resolution

Check with resolvectl whether the queries are being resolved correctly and encrypted.

resolvectl query www.rub.de

Please check the output for the following confirmation:

Data is authenticated: yes; Data was acquired via local or encrypted transport: yes

Windows

In Windows 11 (and newer Windows 10 versions), DNS-over-HTTPS (DoH) can be configured directly via PowerShell.

Configuration via PowerShell

To register the DoH servers of Ruhr University Bochum, run the following commands in a PowerShell with administrator rights:

# Registrierung der IPv6 DoH-Server
Add-DnsClientDohServerAddress -ServerAddress 2a05:3e00:1:1003::32:40 -DohTemplate 'https://ns1.ruhr-uni-bochum.de/dns-query'
Add-DnsClientDohServerAddress -ServerAddress 2a05:3e00:9:1001::222:4 -DohTemplate 'https://ns2.ruhr-uni-bochum.de/dns-query'

# Registrierung der IPv4 DoH-Server
Add-DnsClientDohServerAddress -ServerAddress 134.147.222.4 -DohTemplate 'https://ns2.ruhr-uni-bochum.de/dns-query'
Add-DnsClientDohServerAddress -ServerAddress 134.147.32.40 -DohTemplate 'https://ns1.ruhr-uni-bochum.de/dns-query'

After the servers have been registered, they can be entered as DNS servers in the network settings under Settings > Network and Internet > Ethernet/Wi-Fi. Make sure that under DNS settings the option "Prefer encryption" or "Encryption required" is selected.

Android

Since Android 9 (Pie), the operating system has natively supported DNS-over-TLS under the name Private DNS.

Configuration

  1. Open the Settings.
  2. Go to Connection & Sharing (or Network & Internet > Advanced).
  3. Tap Private DNS.
  4. Select the Private DNS provider hostname option.
  5. Enter the hostname of a supported DNS server, for example:
  6. ns.ruhr-uni-bochum.de
  7. Tap Save.

Once the connection is established, all DNS requests from your device will be transmitted encrypted.