DNS over TLS (DoT)
Relevant source files
The following files were used as context for generating this wiki page:
DNS over TLS (DoT) is a security protocol used in the dns-hardening-parrot project to encrypt DNS queries between the local Unbound resolver and upstream DNS providers. By wrapping DNS queries in a Transport Layer Security (TLS) tunnel, DoT prevents eavesdropping and manipulation by third parties, such as ISPs or attackers performing Man-in-the-Middle (MITM) attacks.
This implementation centralizes DoT at the system level using Unbound, ensuring that all applications benefit from encrypted lookups without requiring individual configuration. The system is designed to place users in the top 1-2% of global DNS security posture by combining DoT with DNSSEC validation and privacy-focused query minimization.
Sources: DNS_Hardening_Complete_Guide.md:4-15, README.md:10-18
System Architecture and Data Flow
The DoT architecture relies on a local Unbound instance acting as a recursive forwarder. Local applications send standard DNS queries to 127.0.0.1:53. Unbound then encapsulates these queries into TLS packets and forwards them to hardened upstream resolvers on port 853.
DNS Query Path
The following diagram illustrates how a DNS request is processed and encrypted before leaving the local system.
This flow ensures that no unencrypted DNS traffic exits the local machine's network interface.
Sources: configs/unbound.conf:5-10, configs/unbound.conf:78-91, UNBOUND_TLS_STATUS.md:44-48
Unbound DoT Configuration
The core of the DoT implementation is defined in unbound.conf. It specifies the use of TLS certificates for verification and defines specific upstream addresses that support the protocol.
Configuration Parameters
The forward-zone section is critical for DoT operation, mapping the root domain . to specific TLS-capable IP addresses and hostnames for SNI verification.
| Option | Value | Description |
|---|---|---|
tls-cert-bundle | /etc/ssl/certs/ca-certificates.crt | Path to system CA certificates for upstream verification |
forward-tls-upstream | yes | Forces Unbound to use TLS for all upstream queries |
forward-first | yes | Attempts forwarding first before falling back to recursion |
forward-addr | IP@853#hostname | Format for specifying DoT providers with port and SNI |
Sources: configs/unbound.conf:34-35, configs/unbound.conf:77-91
Upstream Providers
The system utilizes multiple diverse providers to ensure high availability and resistance to BGP hijacking.
forward-zone:
name: "."
# Cloudflare DNS over TLS
forward-addr: 1.1.1.1@853#cloudflare-dns.com
forward-addr: 1.0.0.1@853#cloudflare-dns.com
# Quad9 DNS over TLS
forward-addr: 9.9.9.9@853#dns.quad9.net
forward-addr: 149.112.112.112@853#dns.quad9.net
Sources: configs/unbound.conf:79-88
Monitoring and Verification
Because DoT operates on a specific port (853), its status can be verified by monitoring active network connections and service health.
TLS Connection States
The project provides a dedicated monitoring script, dns_tls_monitor.sh, which verifies that TLS connections are established on-demand.
Verification Commands
Users can manually verify DoT status using the following tools:
- Check Active Connections:
sudo ss -tnp | grep :853should show established connections to 1.1.1.1 or 9.9.9.9. - DNSSEC Confirmation:
dig @127.0.0.1 google.com +dnssecshould return thead(authenticated data) flag, indicating the path is secure and validated. - Local Resolver Lock:
nslookup google.comshould confirm the server is127.0.0.1.
Sources: UNBOUND_TLS_STATUS.md:7-30, TEST_RESULTS.md:23-55
Security Benefits of DoT Implementation
The implementation of DoT within this project addresses several specific threat vectors:
- ISP Monitoring: By encrypting queries, ISPs cannot log or sell browsing metadata derived from DNS requests.
- DNS Hijacking: Local resolution prevents routers or malicious hotspots from redirecting DNS traffic to phishing sites.
- Integrity: Combined with DNSSEC, DoT ensures that DNS records have not been altered in transit.
- Privacy: Used alongside
qname-minimisation: yes, the amount of data sent to upstream resolvers is strictly limited.
Sources: DNS_Hardening_Complete_Guide.md:214-235, configs/unbound.conf:17-18
Troubleshooting Fallback
If DoT fails, the system may fall back to standard DNS if not properly hardened. The dns_alert.sh and dns_tls_monitor.sh scripts are designed to detect these "Fallback (BAD)" states.
| Symptom | Cause | Mitigation |
|---|---|---|
| No port 853 output | TLS handshake failure or blocked port | Check firewall rules; restart Unbound |
| Queries to 1.1.1.1#53 | Unbound bypassed | Run scripts/dns_harden.sh to lock resolv.conf |
Missing ad flag | DNSSEC validation failure | Ensure system time is correct for certificate/DNSSEC validation |
Sources: UNBOUND_TLS_STATUS.md:34-48, scripts/dns_alert.sh:19-38, scripts/dns_harden.sh:42-53