I am not very familiar with Linux, as I have predominantly been involved with everything Microsoft for the majority of my IT life, but I am just looking at the possibility of implementing a pair of Ubuntu DNS Servers that will perform external lookups using Cloudflare's DNS over TLS.

I have read some articles saying that you can use:

  • Stubby
  • Bind9 with stunnel
  • nginx as a TLS proxy

However, I am not sure of the best and easiest method and just wondered if anyone had an opinion on what I should be using and if there is any documentation on how to setup and configure.


Ideally, DNS over TLS (DoT) should be implemented on the gateway (edge router) of the network, for a home or small office network, it should be implemented on the Internet Gateway. This approach has low management / ops overhead as it is transparent to the clients (configuration can be pushed to clients via DHCP, or manually set).

For example, at home I use AsusWRT-Merlin powered router to do DNS privacy (DoT).

If DoT is only required for a single host, e.g, Linux Server or workstation, use `systemd-resolved is the easiest (OS level).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.