//THE ACADEMY IS GROWING DAILY. CHECK OUT THE FIELD NOTES FROM TECHS HERE AT THE ACADEMY
>_DAEMONCORE // ACADEMY
← FIELD NOTES

Inspecting encrypted DNS with DoH and DoT

2026.10.05//12 MIN READdnsnetworkingsecurity-labsincident-response

// DNS over HTTPS (DoH) and DNS over TLS (DoT)

DNS over HTTPS (DoH) and DNS over TLS (DoT) are protocols designed to enhance user privacy and security by encrypting DNS queries. While they provide substantial benefits, they also present challenges for network visibility and monitoring. Understanding how to decrypt and inspect these protocols can be invaluable for maintaining security posture in your environment.

Why Inspect Encrypted DNS?

The primary reason to inspect encrypted DNS traffic is to ensure that malicious domains are not being resolved by your users' devices. Without visibility into DNS queries, attackers can exploit encrypted DNS to bypass traditional security measures. For example, a user infected with malware might access a command-and-control server using a domain that would otherwise be blocked if the DNS query were visible.

Setting Up Your Environment

Before diving into decryption and inspection, ensure that you have the necessary environment set up. This includes installing a DNS resolver that supports both DoH and DoT. You can use tools like dnscrypt-proxy or unbound for this purpose. Below, I will walk through setting up dnscrypt-proxy for this task.

#### 1. Install dnscrypt-proxy

On a Debian-based system, you can install dnscrypt-proxy using:

sudo apt-get update
sudo apt-get install dnscrypt-proxy

#### 2. Configure dnscrypt-proxy for DoH and DoT

Edit the configuration file located at /etc/dnscrypt-proxy/dnscrypt-proxy.toml. Look for the following lines and adjust them for your needs:

# Enable DNS-over-HTTPS
server_names = ['cloudflare', 'google']
# Enable DNS-over-TLS
require_dnssec = true

This configuration allows you to use Cloudflare and Google DNS servers for both DoH and DoT.

Capture DNS Traffic

To analyze traffic, you can use a packet analyzer like Wireshark. Capture all traffic on the appropriate interface:

sudo wireshark

In Wireshark, apply the following display filter to isolate DNS traffic:

dns || ssl

Decryption of DNS Traffic

To decrypt DoH and DoT, you will need to extract the necessary keys from your client or resolver. For example, when using dnscrypt-proxy, you can see the logs of DNS queries in a human-readable format. Enable logging in your configuration file by setting:

log_file = '/var/log/dnscrypt-proxy.log'

##### Example of Log Output:

After running some DNS queries, you can check the log file:

cat /var/log/dnscrypt-proxy.log

You should see entries similar to:

[2023-10-01 12:34:56] DNS query for example.com: 93.184.216.34
[2023-10-01 12:34:56] DNS query for malicious-site.com: 0.0.0.0

Common Mistakes to Avoid

  • Not enabling logging: Without logs, you won't see any DNS queries when things go wrong.
  • Ignoring traffic filters: When capturing packets, ensure your filters are set correctly to isolate relevant traffic.

Defensive Implications

The ability to decrypt and inspect encrypted DNS queries enables proactive threat detection. If you observe a spike in queries to known malicious domains, you can take immediate action. Additionally, having visibility into user DNS resolutions can help you understand potential insider threats or misconfigurations.

Checklist for Inspection

  • [ ] Install dnscrypt-proxy or similar resolver.
  • [ ] Configure for DoH and DoT.
  • [ ] Enable logging and monitor logs.
  • [ ] Use Wireshark to capture DNS traffic.
  • [ ] Apply proper traffic filters within Wireshark.

Conclusion

Combining DoH and DoT with proper monitoring allows you to maintain security while respecting user privacy. Ensure you have the right tools and configurations to inspect encrypted DNS and act on any anomalies.

--- // FIELDOPS REPORT AUTHORIZED BY: Rachel H. //