Installing Technitium DNS Server on Linux: A Security ‘Shield’ and Ad-Blocker for DevOps – ITFROMZERO

Table of Contents

Why I Chose Technitium DNS Server for My Internal Infrastructure

After auditing security for over 10 projects, I noticed a vulnerability that many often overlook: DNS. Most of us still rely on default ISP DNS or use public DNS like 8.8.8.8. However, plain DNS queries over UDP port 53 are completely unencrypted. This is like sending a postcard that anyone can read along the way, leading to risks of Man-in-the-Middle (MitM) attacks or ISP tracking of your browsing history.

I’ve used Pi-hole and AdGuard Home before. While they are great, as systems get more complex, I needed a real DNS Server with advanced Zone management capabilities like BIND, but with better ease of use. Technitium DNS Server is the answer. It’s an open-source solution running on .NET, offering comprehensive support for modern protocols like DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT).

Deploying your own DNS Server provides two immediate benefits. First, domain resolution is incredibly fast thanks to local caching. Second, you can block ads and trackers right at the network ‘gateway’. Instead of installing ad-blocking apps on every machine, you just configure it once for all devices in your home or office.

Installing Technitium DNS Server on Linux

Technitium can run smoothly on Docker, but for maximum performance and minimum latency in production environments, I prefer installing it directly on Ubuntu Server 22.04 or 24.04.

Step 1: System Preparation

Start by cleaning up and updating basic software packages:

sudo apt update && sudo apt upgrade -y
sudo apt install curl wget apt-transport-https -y

Step 2: Deployment via Automated Script

The Technitium development team provides an excellent installation script. It automatically handles everything from configuring the .NET runtime to setting up the service:

curl -sSL https://download.technitium.com/dns/install.sh | sudo bash

This process usually takes less than 2 minutes. Once finished, the system will notify you that the Web UI is listening on port 5380.

Step 3: Freeing up Port 53

On newer Linux distributions, systemd-resolved often ‘occupies’ port 53, preventing the DNS Server from working. You need to free it up by editing the configuration file:

sudo sed -i 's/#DNSStubListener=yes/DNSStubListener=no/' /etc/systemd/resolved.conf
sudo systemctl restart systemd-resolved

Pro tip: After disabling the Stub Listener, the /etc/resolv.conf file might lose its link. Point it back to localhost so the server itself can benefit from Technitium:

sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

Real-world Configuration: Security and Ad-blocking

Access http://<Server-IP>:5380 to begin. The first thing you must do is set an admin password. Don’t be complacent; the DNS management interface is a highly sensitive area.

Encrypting Queries with DNS-over-HTTPS (DoH)

This is a crucial step for protecting privacy. Instead of sending requests in plain text, we wrap them in an HTTPS tunnel.

Open the Settings -> Proxy tab.
Under Forwarders, enter reputable DoH servers to optimize speed:

https://dns.cloudflare.com/dns-query
https://dns.google/dns-query

Set the Protocol to DNS-over-HTTPS. Now, all DNS requests from your network will be ‘invisible’ to ISP monitoring.

Setting up Ad-blocking Filters

Technitium allows you to load massive blocklists. To activate:

Go to Settings -> Blocking.
Click Add Block List and paste links from trusted sources.
For example, StevenBlack’s list contains over 100,000 malicious domains: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts

My experience: Don’t get greedy by adding too many redundant lists. This only consumes RAM and can easily cause ‘false positives’ that prevent you from accessing normal websites.

Managing Local Domains (Local DNS)

If you’re tired of remembering IPs for services like 192.168.1.50, take advantage of the Zone feature:

Go to Zones -> Create Zone (e.g., homelab.local).
Add an A record pointing dev.homelab.local to the desired IP.

Now, accessing internal services is more professional and faster than ever.

Testing and Performance Optimization

Try changing the DNS on your personal computer to the Technitium server’s IP. Use the dig command to test:

dig @<Technitium-Server-IP> vnexpress.net

If you see the Query time drop from 50ms to 0-1ms on the second query, congratulations, the cache is working perfectly.

Monitoring System Health

The Technitium dashboard isn’t just for show. Pay attention to the Cache Hit Ratio. The higher this ratio, the smoother the browsing experience for users on the network. Additionally, the Blocked Queries section will show you a startling number of junk requests the system has filtered for you.

A note for those using a Raspberry Pi or a weak VPS: Increase the Cache TTL in the Settings. This helps reduce CPU load because the server doesn’t have to re-query popular domains as often.

Building your own DNS Server might take 15 minutes to set up, but the value in security and network cleanliness is immeasurable.