傳統 DNS 查詢和回應會透過 UDP 或 TCP 傳送，而不會經過加密。這很容易遭到竊聽和假冒，包括 DNS 式網際網路篩選。遞迴解析器對用戶端的回應最容易遭受多餘或惡意變更，而遞迴解析器與權威名稱伺服器之間的通訊通常會整合額外的防護措施。
為解決這些問題，Google 公用 DNS 會透過 RFC 7858 指定，透過傳輸層安全標準 (TLS) 加密的 TCP 連線提供 DNS 解析服務。DNS-over-TLS 可提升用戶端和解析器之間的隱私和安全性。這可補強 DNSSEC，並保護 DNSSEC 驗證的結果，避免在用戶端上受到修改或假冒。
運作方式
用戶端系統可以搭配兩種設定檔使用 DNS-over-TLS：採用「嚴格」或「機會式」隱私保護。使用嚴格隱私權設定檔時，使用者必須為 DNS-over-TLS 服務設定 DNS 伺服器名稱 (RFC 8310 中的驗證網域名稱)，且用戶端必須能在通訊埠 853 至 DNS 伺服器的通訊埠 853 上建立安全的 TLS 連線。無法建立安全連線會帶來嚴重錯誤，用戶端也不會有 DNS 服務。
使用機會式隱私權設定檔時，使用者可直接設定 DNS 伺服器 IP 位址，或從本機網路取得 (使用 DHCP 或其他方式)。用戶端解析器會嘗試透過通訊埠 853 與指定 DNS 伺服器建立安全連線。建立安全連線之後，就能保障使用者在路徑上被動觀察器查詢時的隱私。因為用戶端不會驗證伺服器的真實性，也不會受到活動中攻擊者保護。如果用戶端無法在通訊埠 853 上建立安全連線，就會改回使用標準 DNS 通訊埠 53 透過 UDP 或 TCP 與 DNS 伺服器進行通訊，而不需要任何安全性或隱私權。使用機會式隱私保護服務是提高隱私保護的逐步部署方式，並希望廣泛採用嚴格的隱私權設定檔。
使用嚴格隱私權設定檔時，虛設常式解析器會透過下列步驟建立 DNS-over-TLS 連線。
虛設常式解析器是以 DNS-over-TLS 解析器名稱 dns.google 設定。
虛設常式解析器會使用本機 DNS 解析器取得 dns.google 的 IP 位址。
虛設常式解析器會透過這些 IP 位址向通訊埠 853 建立 TCP 連線，
虛設常式解析器會與 Google 公用 DNS 解析器啟動 TLS 握手。
Google 公用 DNS 伺服器會將其傳輸層安全標準 (TLS) 憑證和完整的傳輸層安全標準 (TLS) 憑證完整鏈傳回至信任的根憑證。
虛設常式解析器會根據顯示的憑證驗證伺服器的身分。
如果無法驗證身分，DNS 名稱解析會失敗，虛設常式解析器會傳回錯誤。
建立 TLS 連線後，虛設常式解析器會在 Google 公用 DNS 伺服器之間擁有安全的通訊路徑。
[null,null,["上次更新時間：2025-07-25 (世界標準時間)。"],[[["\u003cp\u003eGoogle Public DNS offers DNS resolution over TLS to enhance privacy and security between clients and resolvers, protecting against eavesdropping and spoofing.\u003c/p\u003e\n"],["\u003cp\u003eDNS-over-TLS operates using strict or opportunistic privacy profiles, with strict requiring authenticated connections to a specific server and opportunistic allowing fallback to unencrypted DNS if TLS fails.\u003c/p\u003e\n"],["\u003cp\u003eClient systems using DNS-over-TLS establish a secure connection by verifying the server's identity through TLS certificates, ensuring data is exchanged over an encrypted channel.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Public DNS supports standards such as TLS 1.3, TCP Fast Open, and DNS Transport over TCP to provide a high-quality and low-latency service.\u003c/p\u003e\n"],["\u003cp\u003eUsers can configure DNS-over-TLS on devices running Android 9 or higher and also utilize it with the IPv6-only Google Public DNS64 service, though the latter is not recommended for mobile devices on multiple networks.\u003c/p\u003e\n"]]],["DNS-over-TLS encrypts DNS queries and responses, enhancing privacy and security. It operates in two profiles: *strict* and *opportunistic*. Strict requires secure TLS connection verification on port 853, failing if validation fails. Opportunistic attempts secure connection on 853 but falls back to unsecured port 53 if it fails, without validating the server. Clients using strict profile resolve the server name, establish a TLS connection on port 853, and validate the server's certificate. Google Public DNS supports this method and follows related RFC specifications.\n"],null,["# DNS-over-TLS\n\nIntroduction\n------------\n\nTraditional DNS queries and responses are sent over UDP or TCP without\nencryption.\nThis is vulnerable to eavesdropping and spoofing\n(including DNS-based Internet filtering).\nResponses from recursive resolvers to clients are the most vulnerable to\nundesired or malicious changes, while communications between recursive resolvers\nand authoritative name servers often incorporate\n[additional protection](/speed/public-dns/docs/security#mitigations).\n\nTo address these problems, Google Public DNS offers DNS resolution over\nTLS-encrypted TCP connections as specified by [RFC 7858](https://tools.ietf.org/html/rfc7858).\nDNS-over-TLS improves privacy and security between clients and resolvers. This\ncomplements DNSSEC and protects DNSSEC-validated results from modification or\nspoofing on the way to the client.\n\nHow it Works\n------------\n\n| **Note:** This section gives an overview of DNS-over-TLS operation when talking to the Google Public DNS resolver (with the name `dns.google`). If you are interested in more details, please read the RFCs [Specification for DNS over Transport Layer Security](https://tools.ietf.org/html/rfc7858) and [Usage Profiles for DNS over TLS and DNS over DTLS](https://tools.ietf.org/html/rfc8310).\n\nA client system can use DNS-over-TLS with one of [two profiles](https://tools.ietf.org/html/rfc8310#section-5):\n*strict* or *opportunistic* privacy. With the strict privacy profile, the user\nconfigures a DNS server name (the *authentication domain name* in\n[RFC 8310](https://tools.ietf.org/html/rfc8310#section-2))\nfor DNS-over-TLS service and the client must be able to create a secure TLS\nconnection on port 853 to the DNS server. Failure to establish a secure\nconnection is a hard error and will result in no DNS service for the client.\n\nWith the opportunistic privacy profile, the DNS server IP address may be\nconfigured directly by the user or obtained from the local network (using DHCP\nor some other means). The client resolver attempts to establish a secure\nconnection on port 853 to the specified DNS server. If a secure connection is\nestablished, this provides privacy for the user's queries from passive observers\non the path. Since the client does not verify the authenticity of the server it\nis not protected from an active attacker.\nIf the client cannot establish a secure connection on port 853, it falls back to\ncommunicating with the DNS server on the standard DNS port 53 over UDP or TCP\nwithout any security or privacy. The use of Opportunistic Privacy is intended to\nsupport incremental deployment of increased privacy with a view to widespread\nadoption of the strict privacy profile.\n\nWhen using a strict privacy profile, stub resolvers establish a DNS-over-TLS\nconnection with the following steps.\n\n1. The stub resolver is configured with the DNS-over-TLS resolver name `dns.google`.\n2. The stub resolver obtains the IP address(es) for `dns.google` using the local DNS resolver.\n3. The stub resolver makes a TCP connection to port 853 at the one those IP address.\n4. The stub resolver initiates a TLS handshake with the Google Public DNS resolver.\n5. The Google Public DNS server returns its TLS certificate along with a full chain of TLS certificates up to a trusted root certificate.\n6. The stub resolver verifies the server's identity based on the certificates presented.\n - If the identity cannot be validated, DNS name resolution fails and the stub resolver returns an error.\n7. After the TLS connection is established, the stub resolver has a secure communication path between to a Google Public DNS server.\n8. Now the stub resolver can send DNS queries and receive responses over the connection.\n\nWhen using an opportunistic privacy profile, the client first attempts to create\na secure TLS connection to the server. This is done similarly to the above with\none important difference - no certificate validation is performed by the client.\nThis means the identity of the server cannot be trusted. If a TLS connection on\nport 853 to the server cannot be established, the stub resolver falls back to\ntalking to the DNS server on port 53.\n| **Note:** To prevent denial of service attacks and resource exhaustion on the server, Google Public DNS may close DNS-over-TLS connections that have been idle too long or when a large number of queries have been received on the connection. The next time the client needs to perform DNS queries, the stub resolver will repeat the steps above to re-establish a connection to the Google Public DNS resolver.\n\nPrivacy\n-------\n\nOur [privacy policy](/speed/public-dns/privacy) applies to the DNS-over-TLS service.\n\nOn 2019/06/27 we have re-enabled [EDNS client subnet (ECS)](/speed/public-dns/docs/ecs)\nfor the DNS-over-TLS service. ECS was disabled at the launch of the service.\n\nStandards Support\n-----------------\n\nGoogle Public DNS implements DNS-over-TLS based on [RFC 7858](https://tools.ietf.org/html/rfc7858).\nIn addition we support the following recommendations to provide a high quality\nand low-latency DNS service.\n\n- [TLS 1.3 (RFC 8846)](https://tools.ietf.org/html/rfc8446)\n- [TCP Fast Open (RFC 7413)](https://tools.ietf.org/html/rfc7413)\n- [DNS Transport over TCP Implementation Requirements (RFC 7766)](https://tools.ietf.org/html/rfc7766)\n\nStart Using It\n--------------\n\nSee [instructions](/speed/public-dns/docs/using#android) to configure it on a\ndevice with Android 9 (Pie) or higher.\n\nDNS-over-TLS is also supported for the IPv6-only\n[Google Public DNS64 service](/speed/public-dns/docs/dns64#secure). Note that configuring DNS64 for a\nmobile device that will attach to multiple networks is not recommended, as DNS64\nonly works when IPv6 is available."]]
