Home › Guides › Linux
Linux · How-to

How to Encrypt Your DNS on Ubuntu with DNS-over-TLS

Stop your ISP from seeing every domain you look up. Configure systemd-resolved to use DNS-over-TLS.

You'll need: Ubuntu 24.04 (or any systemd-based Ubuntu).

Steps

  1. Edit /etc/systemd/resolved.conf.
  2. Set DNS= to your encrypted resolver, e.g. DNS=1.1.1.1#cloudflare-dns.com.
  3. Set DNSOverTLS=yes in the same file.
  4. Restart the resolver: sudo systemctl restart systemd-resolved.
  5. Confirm it's active: resolvectl status should show the encrypted resolver and DNSOverTLS.
  6. Verify no leaks with a DNS leak test site.
Watch outDoT hides the domain names you resolve, not the IPs you connect to. For full privacy you still need HTTPS and ideally a VPN.

Go deeper: Build a Hardened Linux Workstation

The Linux guide covers DoT vs DoH, the exact resolved.conf block, and how to verify with resolvectl.

Get the guide