BIND : DNS over HTTPS : Server Settings2026/04/25

	Configure DNS over HTTPS Server on BIND.
[1]	Get SSL/TLS certificate, refer to here.
[2]	Configure BIND.

root@dlp:~#

openssl dhparam -out /etc/bind/dhparam.pem 3072

root@dlp:~#

cp /etc/letsencrypt/live/dlp.srv.world/{fullchain.pem,privkey.pem} /etc/bind/

root@dlp:~#

chown bind:bind /etc/bind/{fullchain.pem,privkey.pem,dhparam.pem}

root@dlp:~#

vi /etc/bind/named.conf.options

// add settings for certificate
tls local-tls {
        key-file "/etc/bind/privkey.pem";
        cert-file "/etc/bind/fullchain.pem";
        dhparam-file "/etc/bind/dhparam.pem";
};

http local {
    endpoints { "/dns-query"; };
};

options {
.....
.....
        dnssec-validation auto;
        // add and change like follows
        listen-on tls local-tls http local { any; };
        listen-on-v6 tls local-tls http local { any; };
};

root@dlp:~#

systemctl restart named

[3]	If UFW is enabled allow HTTP service.

root@dlp:~#

ufw allow http

Rule added
Rule added (v6)
root@dlp:~#

ufw allow https

Rule added
Rule added (v6)

[4]	Verify Name Resolution with HTTPS on localhost.

root@dlp:~#

dig +https @127.0.0.1 dlp.srv.world.


; <<>> DiG 9.20.18-1ubuntu2-Ubuntu <<>> +https @127.0.0.1 dlp.srv.world.
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 197
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 27ecaef2ed6fdd3d0100000069ec43fd8965d4eae5bf67f6 (good)
;; QUESTION SECTION:
;dlp.srv.world.                 IN      A

;; ANSWER SECTION:
dlp.srv.world.          86400   IN      A       10.0.0.30

;; Query time: 0 msec
;; SERVER: 127.0.0.1#443(127.0.0.1) (HTTPS)
;; WHEN: Sat Apr 25 04:33:01 UTC 2026
;; MSG SIZE  rcvd: 86

Matched Content