What is DNS-over-TLS?

Encrypting your DNS lookups over TLS so your ISP and network can't see which domains you resolve — configured via systemd-resolved on Ubuntu.

How it works

Plain DNS leaks every site you visit to your ISP in cleartext. DNS-over-TLS wraps queries in encryption. It hides the names you look up, not the IPs you connect to.

Example

In practiceSet DNSOverTLS=yes and an encrypted resolver in resolved.conf, then confirm with a DNS leak test.

DoT or DoH?

Both encrypt DNS. DoT uses port 853; DoH looks like HTTPS traffic. On a desktop, DoT via systemd-resolved is the clean choice.

Go deeper: Build a Hardened Linux Workstation

The complete, step-by-step guide — every command, config, and the reasoning behind it.

Get the guide