How to Configure DNS Over HTTPS (doh) on Ubuntu Using Dnscrypt-proxy

ByAkensai

Learning how to configure DNS Over HTTPS (DoH) on Ubuntu using Dnscrypt-proxy is one of the smartest moves you can make for your server’s privacy. By default, DNS queries travel in plain text. Anyone on your network can read them. ISPs, hackers, and surveillance tools can all see exactly which domains you visit. DNS Over HTTPS encrypts those queries inside HTTPS traffic. This makes them invisible to outside observers. Dnscrypt-proxy is a lightweight, flexible tool that handles this encryption on Ubuntu without heavy dependencies. In this tutorial, you will install and configure Dnscrypt-proxy on Ubuntu, point your system resolver to it, and verify that your DNS traffic is fully encrypted. This guide targets Ubuntu 20.04 and 22.04. It works on both desktop and server installations. Whether you manage a VPS or a local workstation, you’ll finish this tutorial with a working DoH setup in about 20 minutes.

Prerequisites and Requirements for DNS Over HTTPS on Ubuntu

Before you start, make sure your environment meets these requirements.

System requirements:

  • Ubuntu 20.04 LTS or Ubuntu 22.04 LTS (desktop or server)
  • A user account with sudo privileges
  • Basic familiarity with the Linux terminal
  • An active internet connection

Knowledge assumed:

  • You can open a terminal and run commands
  • You understand what DNS is and how it works
  • You’re comfortable editing config files with a text editor like nano

Estimated time: 15–25 minutes

You don’t need to install anything manually ahead of time. The tutorial covers every package you need. You should also know that Dnscrypt-proxy will replace your current DNS resolver. If you run a web server or other services that depend on DNS, test this in a staging environment first. For reference on how Ubuntu handles DNS resolution, check the official Ubuntu Server DNS documentation.

How to Configure DNS Over HTTPS on Ubuntu Using Dnscrypt-proxy

Related tutorial: How to Set Up Automated Mysql Database Backups with Cron Jobs

Follow these steps carefully. Each step builds on the previous one.

Step 1: Update your package list

Always start by refreshing your package index. This ensures you get the latest available version of every package.

sudo apt update && sudo apt upgrade -y

Step 2: Install Dnscrypt-proxy

Ubuntu’s default repositories include Dnscrypt-proxy. Install it with a single command.

sudo apt install dnscrypt-proxy -y

After installation, the service may start automatically. Check its status before making any changes.

sudo systemctl status dnscrypt-proxy

Step 3: Edit the Dnscrypt-proxy configuration file

The main config file lives at /etc/dnscrypt-proxy/dnscrypt-proxy.toml. Open it with nano.

sudo nano /etc/dnscrypt-proxy/dnscrypt-proxy.toml

Find the listen_addresses line. By default it looks like this:

listen_addresses = ['127.0.0.1:53']

Leave this as-is unless port 53 is already in use. Next, find the server_names line and specify your preferred DoH servers. For example:

server_names = ['cloudflare', 'google']

You can find a full list of supported resolvers in the official Dnscrypt resolvers repository on GitHub. Choose servers that match your privacy needs. Scroll down and make sure doh_servers is set to true and dnscrypt_servers is set to false if you want DoH only.

doh_servers = true
dnscrypt_servers = false

Save and close the file with Ctrl+O, then Enter, then Ctrl+X.

Step 4: Disable systemd-resolved on port 53

Ubuntu uses systemd-resolved by default. It listens on port 53 and will conflict with Dnscrypt-proxy. You need to stop it from occupying that port.

Open the resolved config file:

sudo nano /etc/systemd/resolved.conf

Find and update these lines:

[Resolve]
DNS=127.0.0.1
DNSStubListener=no

Save the file. Then restart the resolved service.

sudo systemctl restart systemd-resolved

Step 5: Update the resolv.conf symlink

Ubuntu’s /etc/resolv.conf is usually a symlink managed by systemd-resolved. You need to point it to a static file so Dnscrypt-proxy takes control.

sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

Then manually set the nameserver to localhost:

echo "nameserver 127.0.0.1" | sudo tee /etc/resolv.conf

Step 6: Enable and restart Dnscrypt-proxy

Enable Dnscrypt-proxy so it starts on every boot. Then restart it to apply your config changes.

sudo systemctl enable dnscrypt-proxy
sudo systemctl restart dnscrypt-proxy

Check the service status one more time to confirm it’s running without errors.

sudo systemctl status dnscrypt-proxy

Step 7: Verify DNS Over HTTPS is working

Use dig to test DNS resolution through your new setup.

dig google.com @127.0.0.1

You should see a valid response with an answer section. If you do, your DNS queries are now encrypted. You can also run a quick check with dnscrypt-proxy itself:

sudo dnscrypt-proxy -resolve google.com

This command shows which resolver handled the query and confirms DoH is active.

Troubleshooting Common DNS Over HTTPS Issues

Even with careful steps, things can go wrong. Here are the most common problems and how to fix them.

Port 53 is already in use

If Dnscrypt-proxy fails to start, another process is likely holding port 53. Check which process uses it:

sudo ss -tulnp | grep :53

If systemd-resolved appears, repeat Step 4. Make sure DNSStubListener=no is saved correctly.

DNS resolution fails completely

If you can’t resolve any domain after setup, your resolv.conf may be wrong. Check its contents:

cat /etc/resolv.conf

It should show nameserver 127.0.0.1. If it doesn’t, repeat Step 5.

Dnscrypt-proxy service won’t start

Check the logs for specific errors:

sudo journalctl -u dnscrypt-proxy -n 50

Look for lines mentioning config file syntax errors or connection failures. A typo in the .toml file is the most common cause. Re-open the config and check your formatting carefully.

Wrong server selected

If you specified server names that don’t exist in the resolver list, Dnscrypt-proxy will fall back or fail. Double-check your server_names values against the official resolver list linked in Step 3.

Conclusion

You now know how to configure DNS Over HTTPS (DoH) on Ubuntu using Dnscrypt-proxy from start to finish. Your DNS queries are encrypted and no longer exposed to plain-text interception. You installed Dnscrypt-proxy, configured it to use DoH-only resolvers, resolved the port conflict with systemd-resolved, and verified everything works. This setup gives you a meaningful privacy improvement with minimal performance overhead. From here, you might explore blocking ads at the DNS level using Dnscrypt-proxy’s built-in blocklist feature. You could also combine this setup with a VPN for even stronger network privacy. Whatever your next step, you’ve built a solid foundation with encrypted DNS on Ubuntu.

Similar Posts