dnss is a daemon for using DNS over HTTPS.
It can act as a proxy, receiving DNS requests and resolving them using DNS-over-HTTPs (DoH). This can be useful to improve DNS security and privacy on laptops and small/home networks.
It can also act as a DoH server, in case you want end to end control.
dnss package installs the daemon configured in proxy mode and ready to
use, using Google's public resolvers (and easily changed via configuration).
sudo apt install dnss
To download and build the binary:
go install blitiri.com.ar/go/dnss
And if you want to configure the daemon to be automatically run by systemd:
# Copy the binary to a system-wide location. sudo cp "$GOPATH/bin/dnss" /usr/local/bin/ # Set it up in systemd. sudo cp "$GOPATH"/src/blitiri.com.ar/go/dnss/etc/systemd/dns-to-https/* \ /etc/systemd/system/ sudo systemctl dnss enable
Listens on port 53 for DNS queries, resolves them using the given HTTPS URL.
# Use the default HTTPS URL (currently, dns.google): dnss -enable_dns_to_https # Use Cloudflare's 184.108.40.206: dnss -enable_dns_to_https -https_upstream="https://220.127.116.11/dns-query" # Use Google's dns.google: dnss -enable_dns_to_https -https_upstream="https://dns.google/dns-query" # Use the default HTTPS URL for all resolutions, except for domain "myhome" # which is resolved via a local DNS server. dnss -enable_dns_to_https -dns_server_for_domain="myhome:10.0.1.1:53"
Receives DNS over HTTPS requests, resolves them using the machine's configured DNS servers, and returns the replies. You will need to have certificates for the domains you want to serve.
Supports both DoH and JSON modes automatically, and the endpoints are
# Serve DNS over HTTPS requests, take certificates from letsencrypt. DOMAIN=yourdomain.com dnss -enable_https_to_dns \ -https_key=/etc/letsencrypt/live/$DOMAIN/privkey.pem \ -https_cert=/etc/letsencrypt/live/$DOMAIN/fullchain.pem