Keep the conversation private.
Choose an encrypted transport, then configure the certificates and listeners it needs.
Choose your transport
NothingDNS supports DNS over HTTPS, DNS over TLS, DNS over QUIC, and Oblivious DNS over HTTPS. Each serves a different client and deployment need. Configure only the listeners you intend to expose.
DNS over HTTPS
The HTTP listener serves DoH when TLS is configured and doh_enabled is true. Replace the example certificate paths with valid certificates for your server.
server:
http:
enabled: true
bind: "127.0.0.1:8443"
tls_cert_file: /etc/nothingdns/tls/server.crt
tls_key_file: /etc/nothingdns/tls/server.key
doh_enabled: true
doh_path: /dns-queryVerify the answer with DNSSEC
Encrypted transport protects the connection. DNSSEC verifies signed DNS data. Enable validation independently, and use the signing configuration when serving your own signed zones.
dnssec:
enabled: true
trust_anchor: ""Plan your production setup
Use the repository’s security and deployment documentation for listener configuration, trusted networks, certificates, and dashboard protection.