DNS over TLS

A dot DNS server is tcp's framing inside TLS (RFC 7858): one connection reused, queries pipelined. Port 853 by default.

Structure

{
  "tag": "cloudflare",
  "type": "dot",
  "settings": { "server": "1.1.1.1", "timeout": "5s" },
  "tls": { "server_name": "one.one.one.one" },
  "outbound": "direct"
}

Fields

settings.server

stringRequired

An IP or hostname with an optional port: "1.1.1.1", "dns.google:853".

settings.timeout

durationDefault: 5s

How long one query may take, including reaching the server.

tls

object

tls transport settings for the TLS to the DNS server. Set server_name when server is an IP.

TIP

To hide the ClientHello from the network, send the queries through an outbound with fragment, or through a proxy.

The common fields (tag, outbound, ip_versions, dns_server) are on DNS server.