DoT: how DNS over TLS resolver resolves its own hostname

Question

It is possible to use hostname of DNS resolver instead of IP address (e.g. in Android 9+) for DNS over TLS servers.

Google provides dns.google and Cloudflare offers 1dot1dot1dot1.cloudflare-dns.com but as you can see these aren't IP addresses.

So how exactly their own address is resolved since they are resolvers themselves?

score 4 · Accepted Answer · answered Aug 07 '20 at 08:58

There are a few ways:

The client may use regular plaintext DNS as the bootstrap mechanism. Once the DoH/DoT resolver's IP address is known, it will switch over to TLS mode. This works with any provider.
Some servers actually have a certificate valid for their IP address, so you don't need to input the hostname – you can input the IP address like you did in the past. For example, both Google 8.8.8.8 and Cloudflare 1.1.1.1 will directly accept TLS connections for both DoH and DoT. This is relatively rare.
Some clients let you input the IP address and the certificate name separately. For example, on Linux with Unbound as the DoT client, you can specify "Use 8.8.8.8 as resolver, but expect 'dns.google' as its certificate". (Yes, Google indeed uses the same 8.8.8.8 IP address for DoH/DoT as it does for regular DNS.)

score 0 · Answer 2 · answered Aug 07 '20 at 12:57

Most DNS servers are configured to point to themselves as resolvers, either primary or secondary. This is done manually when setting up the server.

Under some architectures, the DNS server should configure itself only as secondary resolver. An example is if the DNS server is also a domain controller and it points only to itself for name resolution, then it can become an island and fail to replicate with other domain controllers (link).

This is recommended (or mandatory) by various sources. A quick search found:

DoT: how DNS over TLS resolver resolves its own hostname

2 Answers2