Back up to the Routers Category

DoH and DoT

From AAISP Support Site
Jump to navigation Jump to search

A trial service

A&A run DNS over HTTPS (DoH) and DNS over TLS (DoT) resolvers for customer use. There is information here at which includes information on privacy and the terms and conditions.

As of September 2019, this is considered a 'trial' service, but is expected to continue and be an 'official' service for customers.

A&A DNS Servers

Service server Description
DoH Usually set in your web browser, where supported.
DoT Usually set in your operating, where supported.
Standard DNS
Our standard 'port 53' servers, widely used (everywhere).

Our privacy statement and terms can be found at:

Testing if it’s working

We have a testing domain, if you go to you will be directed to a page saying if your browser used DoT or DoH. The DNS lookup and page will fail if you are not using our DoT or DoH servers. (currently only over IPv6 and HTTP)

Help setting DoH or DoT on browsers and devices

At the moment there is limited support for DoT and DoH on computers generally. Browsers are starting to support DoH, and Android from version 9 supports DoT. macOS and iOS support DoH/DoT by loading a custom profile. These are new protocols and it will take time before they are widely used.

General resources


DoH is supported in Firefox's UI in version 69 and up.

  1. Menu
  2. Preferences
  3. Scroll down to Network Setting...
  4. Scroll down and tick 'Enable DNS over HTTPS' and enter in a Custom provider:

Checking your browser

In your Firefox URL bar, type: about:networking and enter. Then click DNS on the left, and you should see your DNS lookups, and they should have TRR (Trusted Recursive Resolver) listed as true.


DoH is expected to be a feature in Chrome version 78 or 79.

Android (DoT)

DoT is supported in Android version 9 (Pie) and up

  1. Settings
  2. Search for “DNS” in settings search bar
  3. Go to PrivateDNS setting screen
  4. Tap ‘Private DNS provider hostname’ and set:
  5. Click Save


This has been tested on iOS 15. It sensibly warns you that the config isn't signed and that someone could spy on your phone's DNS, but if you click through it seems to "just work". You should review mobileconfig profiles before installing.

  1. Download the mobileconfig file for the service you want to enable: DoH or DoT
  2. Navigate to the downloaded file in the "files" app and open it - this should add it to settings
  3. Navigate to the "VPN & Device Management" section of settings and review the profile - this should activate it


Stubby is an application acts as a local DNS resolver on port 53 but does its lookups over TLS (DoT) which means it can act as a DNS proxy for your whole machine.

Adding our servers should be enough:

 - address_data: 2001:8b0::2022
   tls_auth_name: ""
 - address_data: 2001:8b0::2023
   tls_auth_name: ""
 - address_data:
   tls_auth_name: ""
 - address_data:
   tls_auth_name: ""

And once running, test with

dig +short @::1

If resolves to then it wasn't using our DoT servers.

Using DOH with curl

Curl version 7.62.0 and above support using DoH for its DNS lookups. Here's an example:

curl --doh-url


curl --doh-url

This will download the webpage and would have used the DOH server to resolve the DNS.