DNS over TLS

[mika]

Hello there,

actually till now I didn't pay much attention to the security of DNS, as FF is securing it through HTTPS already. But I wanted to configure Opnsense, so that it would work as a Resolver but also look up at specific DNS over TLS for unknown addresses, but it kinda still goes over Port 53 and is not using the specified DNS's. I don't know why, as I also disabled the DNS server options.

[meyergru]

Your question is waaaay too unspecific. It still goes over port 53 - "it" meaning what, exactly?

What type of DNS service do your clients use? Unbound, DNSmasq, OpenDNS, Bind or something else? How do you know that they do not use something else despite you sending them OpnSense's IP via DHCP, like 8.8.8.8?

Aside from your clients, does your OpnSense itself use upstream or configured servers?

You know, DNS is not as easy as it used to be these days.

[tangofan]

I also disabled the DNS server options.

In addition to what @meyergru said, I also suggest to be a bit more specific about the statement above, that is where did you change what exactly?