Fedora Security: Enable DNS-over-TLS (DoT) in 5 Minutes with systemd-resolved

Why should you care about DNS-over-TLS?

I’ve been using Fedora as my primary workstation for over two years. This distro is excellent for package update speeds, but there’s one security loophole many people overlook: DNS. Normally, when you type google.com, your computer asks a DNS server for the IP address. The catch is that this “conversation” usually happens in clear text.

Think of it like sending a postcard through the mail. Anyone in the delivery chain—from your ISP and the Wi-Fi owner at a coffee shop to hackers—knows which websites you’re visiting. They can even modify the results to redirect you to a phishing site in an instant.

DNS-over-TLS (DoT) was created to end this. It puts that postcard into a TLS-encrypted envelope (similar to how HTTPS protects the web). On Fedora, we have systemd-resolved built-in to handle this without needing third-party apps.

Step 1: Check the “health” of systemd-resolved

Most modern Fedora Workstation versions have systemd-resolved enabled by default. However, it’s better to be safe. Let’s check the service status before starting the configuration.

Type the following command into your terminal:

systemctl status systemd-resolved

If you see active (running) in green, you’re good. If the service is off, wake it up with this command:

sudo systemctl enable --now systemd-resolved

Next, confirm if the /etc/resolv.conf file is correctly pointing to systemd-resolved. Fedora uses a symbolic link (symlink) to manage this:

ls -l /etc/resolv.conf

The standard result should point to ../run/systemd/resolve/stub-resolv.conf. If you see a different path, run this command to recreate it:

sudo ln -sf ../run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

Step 2: Configure DNS Encryption

Now for the most important part. We will force the system to use DNS servers that support TLS and enable full encryption.

Open the configuration file with nano (or vi if you’re a hardcore fan):

sudo nano /etc/systemd/resolved.conf

Find the [Resolve] section and modify it as follows (remember to remove the # at the beginning of the lines):

[Resolve]
DNS=1.1.1.1#cloudflare-dns.com 9.9.9.9#dns.quad9.net
DNSOverTLS=yes
DNSSEC=yes
Domains=~.

Parameter breakdown:

• DNS: I’m using Cloudflare (1.1.1.1) and Quad9 (9.9.9.9). The IP#hostname structure helps TLS verify the server certificate, preventing spoofing.
• DNSOverTLS=yes: Forces all queries to be encrypted. If set to opportunistic, the system will automatically downgrade to clear text if the server doesn’t support TLS (less secure).
• DNSSEC=yes: Validates digital signatures to ensure DNS data hasn’t been tampered with in transit.
• Domains=~.: This tilde and dot requirement tells the system to use these servers for all domains (global).

Press Ctrl + O, then Enter to save, and Ctrl + X to exit.

Step 3: Activate the Changes

To make the new settings take effect, simply restart the service. This process takes less than a second and won’t drop your connection.

sudo systemctl restart systemd-resolved

If you use NetworkManager, it might sometimes try to push the ISP’s DNS. However, direct configuration in resolved.conf usually takes the highest priority.

Step 4: Verify the Results

Just because it’s configured doesn’t mean it’s running. Use the following methods to ensure you’ve successfully “gone dark”.

Method 1: Using the resolvectl command

This is the fastest way to inspect the internal DNS status:

resolvectl status

Scroll down to the active network interface (like wlp2s0). If you see the line Protocols: +DefaultRoute +LLMNR -mDNS +DNSOverTLS DNSSEC=yes, you’ve succeeded.

Method 2: Check via web

Visit 1.1.1.1/help. Look at the Using DNS over TLS (DoT) section. If it says Yes, congratulations—your ISP now only sees a bunch of meaningless encrypted data.

Method 3: Packet Capture (For hardcore users)

Traditional DNS runs on port 53, while DoT runs on port 853. You can check if the machine is actually sending data via port 853:

sudo tcpdump -i any port 853

Run the command above and then load any website. If the terminal displays a stream of data, the encryption is working perfectly.

Real-world experience using DoT

After using DoT on Fedora for a long time, I have a few small tips for you:

1. Office network issues: Some office firewalls block port 853 to force employees to use internal DNS. If you can’t access the internet, try temporarily changing DNSOverTLS to opportunistic.
2. Latency: DoT adds about 100-200ms for the initial TLS handshake. However, thanks to keep-alive mechanisms, you’ll barely notice a difference during daily browsing.
3. VPN Conflicts: VPN apps often override DNS configurations. If you use a VPN, check if the app has its own DoT option to avoid DNS leaks.

With just a few lines of code, you’ve upgraded the security layer of your Fedora machine. This is a basic but extremely valuable setup step to protect your privacy in today’s risky internet environment.