Set up secure DNS (over TLS or HTTPS) on 16.04

Question

How do I set up Secure DNS (eg over TLS or HTTPS) on 16.04?

I would prefer to use functionality built into 16.04 or apps available on the 16.04 repository. I plan to use either the Google Public DNS (eg 8.8.8.8, 8.8.4.4) or Cloudflare (1.1.1.1, 1.0.0.1) or some combination of the two.

From a web search, the commonly recommended way is to use stubby on 18.04 for DNS over TLS, but stubby does not seem to be available on the 16.04 repository.

Current options for DNS over HTTP seems to be cloudflared by Cloudfare and doh-proxy by Facebook, neither of which seem to be available on the 16.04 repository.

Answer 1

In Ubuntu there is the dnss package (official site)

From man page:

dnss is a daemon that can encapsulate DNS over HTTPS.

It can act as a DNS-to-HTTPS proxy, using https://dns.google.com as a server or anything implementing the same API.

It can also act as an HTTPS-to-DNS proxy, implementing the same HTTP API; you can use this instead of https://dns.google.com if you want more control over the servers and the final DNS server used (for example if you are in an isolated environment, such as a test lab or a private network).

In the default mode of operation, it listens for DNS requests on port 53, and will query an HTTPS server (https://dns.google.com by default) to resolve them.

Answer 2

On Firefox, you can enable this by navigating to the browser's Settings → Network Settings and checking Enable DNS over HTTPS as shown in the screenshot:

Chrome/Chromium/Brave has a similar setting, which you can enable by navigating to the browser's Settings → Privacy and security → Advanced → Use secure DNS.