Linux Security: Implementing DoH and DoT to ‘Stay Hidden’ from ISPs

The ‘Open Flank’ Vulnerability of Traditional DNS

After over 6 years of managing Linux systems from labs to production, I’ve noticed a fundamental oversight: 90% of folks often forget the DNS protocol. By default, DNS runs on port 53 and sends data in plaintext. This makes it easy for ISPs or anyone ‘in the middle’ to see exactly which websites you’re visiting. Even if the website uses HTTPS, the domain name is still exposed.

Worse yet, ISPs can use DNS Hijacking techniques to redirect you to advertising pages or block access entirely. That’s why I’ve migrated my entire infrastructure to DNS over TLS (DoT) and DNS over HTTPS (DoH) over the past six months. The results have been very positive: no more tracking concerns, and resolution speeds are even more stable thanks to intelligent caching.

Upgrade to DoT in 5 Minutes with systemd-resolved

If you’re using recent versions of Ubuntu, Debian, or CentOS, systemd-resolved is the shortest path. You can deploy DoT immediately without needing complex third-party software.

Step 1: Edit the Configuration File

sudo nano /etc/systemd/resolved.conf

Find and edit the following lines (remember to uncomment the # at the beginning):

[Resolve]
DNS=1.1.1.1 8.8.8.8
# Use Cloudflare or Google IPs
DNSOverTLS=yes
DNSStubListener=yes

Step 2: Activate and Verify

sudo systemctl restart systemd-resolved
sudo resolvectl status

In the interface information section, if you see the line DNS over TLS: yes, it means you’ve succeeded. From now on, all your DNS queries are wrapped in an encrypted TLS layer on port 853, making them extremely secure.

DoT vs DoH: Which is the Optimal Choice for Your Server?

In production environments, each protocol has its own advantages:

• DNS over TLS (DoT): Runs on a dedicated port 853. It’s clean and easy to manage from a network perspective. However, if corporate firewalls are too strict, port 853 is easily blocked.
• DNS over HTTPS (DoH): Shares port 443 with standard web traffic. DoH is extremely difficult to block because blocking it would also break the web. In return, you often need an internal proxy like cloudflared for configuration.

To quickly calculate IP ranges for this DNS server cluster, I often use toolcraft.app/en/tools/developer/ip-subnet-calculator. Simply enter the CIDR to get the network range, broadcast, and available hosts, which makes VLAN partitioning and firewall configuration much more accurate.

Advanced: Installing a DoH Proxy with Cloudflared

Cloudflared is the top choice if you need the highest security or want to effectively bypass ISP restrictions. I’ve tested it on mail server systems, and it runs extremely reliably.

1. Quick Installation

wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared-linux-amd64.deb

2. Service Setup

Create a configuration file at /etc/default/cloudflared with the following content:

CLOUDFLARED_OPTS=--proxy-dns=true --proxy-dns-port=5053 --proxy-dns-upstream https://1.1.1.1/dns-query --proxy-dns-upstream https://8.8.8.8/dns-query

Note: I use port 5053 to avoid conflicts with default DNS services on the machine.

3. Run Automatically at Startup

sudo cloudflared service install

Finally, you just need to point your system DNS to 127.0.0.1#5053, and all traffic will be protected by DoH.

Verifying Traffic: Don’t Just Trust Theory

As tech people, we need to see it with our own eyes. I often use tcpdump to inspect packets. With traditional DNS, the domains you visit are clearly visible. With DoT/DoH, everything is just encrypted character strings.

Try capturing packets on port 53 (Standard DNS):

sudo tcpdump -ni any port 53

If the screen stays quiet while you browse, the configuration is correct. Next, try monitoring port 853:

sudo tcpdump -ni any port 853

Data will stream in continuously as TLS (Encrypted Application Data) — this is your success.

Practical Experience After 6 Months of Use

Don’t Worry Too Much About Latency

Many folks worry that encryption slows down web browsing. In reality, the initial query is only about 15ms slower. Subsequent queries, thanks to the systemd-resolved cache, are nearly instantaneous. Unless you’re doing High-Frequency Trading, average users won’t notice a difference.

Handling Local Domains

One ironic issue I encountered was being unable to access internal servers (like gitlab.local) after enabling DoT. This happened because all queries were pushed to Cloudflare. The solution is using Split DNS: encrypt outgoing internet traffic while letting the internal DNS handle local domains as before.

Final Thoughts

Switching to DoH/DoT isn’t just about security; it’s also a way to escape annoying ISP ad-injection scripts. If you’re managing a Linux server, I recommend enabling DoT today. It takes less than 5 minutes to configure, but the privacy value is immense.