Encrypt your DNS on Ubuntu in five minutes

Every website you visit starts with a DNS query — your computer asking "what is the IP address of this domain?" By default those queries travel in plain text. Your ISP can read them. Your network administrator can read them. Anyone monitoring the network can read them, log them, and sell them. Even when the site itself is HTTPS, the DNS lookup that got you there wasn't.

The fix is encrypted DNS, and on Ubuntu you don't need to install anything to get it: systemd-resolved, the resolver Ubuntu already ships, speaks DNS-over-TLS (DoT) natively. Five minutes of configuration and every lookup your machine makes is wrapped in TLS.

DoT vs. DoH, in one paragraph

There are two common forms of encrypted DNS. DNS-over-TLS (DoT) encrypts queries system-wide at the resolver level — every app benefits, no exceptions. DNS-over-HTTPS (DoH) tunnels queries inside HTTPS and is what browsers implement themselves. Browser DoH only protects the browser; DoT at the system resolver protects everything. Ubuntu's built-in resolver speaks DoT, so that's what we configure.

Configure DNS-over-TLS with systemd-resolved

Ubuntu 24.04 uses systemd-resolved for DNS. Point it at Cloudflare's privacy-respecting resolver, turn on TLS and DNSSEC, and restart:

# Edit the resolved configuration
sudo nano /etc/systemd/resolved.conf

# Set these values under [Resolve]:
# DNS=1.1.1.1 1.0.0.1
# FallbackDNS=9.9.9.9 149.112.112.112
# DNSSEC=yes
# DNSOverTLS=yes

# Restart resolved
sudo systemctl restart systemd-resolved

# Verify the configuration
resolvectl status

That's the entire change. DNS= sets Cloudflare's two anycast resolvers, FallbackDNS= keeps Quad9 as a backup, DNSSEC=yes validates that answers haven't been tampered with, and DNSOverTLS=yes is the line that stops the plain-text leaking.

Verify it's actually working

Never trust a security change you haven't verified:

# Check DNS resolution and see which server answered
resolvectl query example.com

# Confirm DNSSEC validation is active
resolvectl statistics | grep DNSSEC

Then run the extended test at dnsleaktest.com. Every result should show Cloudflare (1.1.1.1) — and only Cloudflare. If your ISP's resolvers still appear, something on your network (usually the router's DHCP settings) is overriding you.

Level up: NextDNS

If you want more than privacy, NextDNS is an excellent alternative to Cloudflare. It offers both DoT and DoH, DNSSEC, ad and tracker blocking at the DNS level, and query logs that you control. The free tier covers 300,000 queries a month — enough for most people. Configuration is identical: replace the addresses above with your personal NextDNS endpoints.

Blocking trackers, malware domains, and ads at the DNS level stops them before they reach any browser or app — more effective than browser-level blocking alone.

One layer of eleven

Encrypted DNS closes one leak. A hardened workstation closes them all: full-disk encryption, a default-deny firewall, SSH that can't be brute-forced, AppArmor confinement, encrypted backups, and the operational habits that keep it all working.

Next up: harden SSH in three moves — the most-attacked door on any machine.