---
url: /apranik/configuration/dns/dot.md
---
# DNS over TLS

A `dot` DNS server is [`tcp`](tcp.md)'s framing inside TLS (RFC 7858): one connection reused, queries pipelined. Port `853` by default.

## Structure

```json
{
  "tag": "cloudflare",
  "type": "dot",
  "settings": { "server": "1.1.1.1", "timeout": "5s" },
  "tls": { "server_name": "one.one.one.one" },
  "outbound": "direct"
}
```

## Fields

### `settings.server`

string
Required

An IP or hostname with an optional port: `"1.1.1.1"`, `"dns.google:853"`.

### `settings.timeout`

duration
Default: 5s

How long one query may take, including reaching the server.

### `tls`

object

[`tls` transport settings](../transport/tls.md) for the TLS to the DNS server. Set `server_name` when `server` is an IP.

> \[!TIP]
> To hide the ClientHello from the network, send the queries through an `outbound` with [`fragment`](../transport/fragment.md), or through a proxy.

The common fields (`tag`, `outbound`, `ip_versions`, `dns_server`) are on [DNS server](server.md).