Warning: This document is old! It is likely wrong in some important way.
Why DNS over HTTPS?
DNS over HTTPS (or DoH or 🍩) is a protocol that makes browsing more private. Browsers typically resolve domain names with an unencrypted protocol, allowing nosy neighbors and internet providers to snoop on some internet activity. DoH creates an encrypted connection between browsers and the DNS resolver to make it difficult to even see what domains a user is loading.
Firefox now uses DNS over HTTPS by default in the US and DNS over HTTPS can easily be enabled elsewhere in the world. With the release of version 83, Chrome has gained official support for DNS over HTTPS (see this Chrome Blog post for details). And Microsoft is planning to enable DNS over HTTPS in Windows 10.
It’s useful to be able to run private services for protocols like DoH. If you pipe all your encrypted DNS requests to one shared provider, you’re essentially just swapping one nosy ISP for an even bigger internet provider. Fly is an especially good place to run DNS services because we deploy apps globally and the internet is faster when DNS is close by. And if you want to, you can even manage your own TLS.
Prerequisites
Install Fly CLI
If you’re on a Mac, you can install the CLI with Homebrew:
For other systems, download and run the install script:
Sign In (or Up) for Fly
If you have a Fly account, all you need to do is sign-in with flyctl.
New User?
Welcome to Fly. To get your Fly account run:
This will take you to the sign-up page where you can either:
-
Sign up With Email: Enter your name, email and password.
-
Sign up With GitHub: If you have a GitHub account, you can use that to sign up. Look out for the confirmatory email we will send you which will give you a link to set a password; you’ll need a password set so we can actively verify that it is you for some Fly operations.
Returning User
Run:
Your browser will open up with the Fly sign-in screen. Enter your user name and password to sign in. If you signed up with GitHub, use the Sign in with GitHub button to sign in.
Whichever route you take you will be signed-up, signed-in and returned to your command line, ready to Fly.
Create a Fly App
Pick a name for your new DNS over HTTPS service. Then create a Fly app:
Two-minute easy mode
We’ve published a Docker image you can use to get started.
1. Deploy flyio/doh-proxy from Docker Hub
2. Use https://[your-app-name].fly.dev/dns-query
Your new Fly app includes dedicated IP addresses and a [your-app-name].fly.dev hostname with a valid certificate. You can see these by running flyctl info:
The URL for DNS queries is: https://[your-app-name].fly.dev/dns-query, you can use it in any app that supports DNS over HTTPS.
You can also try it out with curl:
Hard mode (maybe 10 minutes)
1. Write a Custom Dockerfile
We use Docker to build and package applications. For custom builds, you’ll need a Dockerfile in your working directory — here’s a good one for doh-proxy:
2. Deploy working directory with flyctl
The Fly CLI will build + deploy a Docker image in one step. Just run flyctl deploy in your working directory. If Docker is running locally, we’ll do a local build. If you don’t have docker installed, we copy the contents of your working directory and perform a build on our servers.
This could take a while on the first one. Subsequent runs will reuse image layers and finish quite a bit faster.
Optional configuration
Use a Different Resolver
The doh-proxy project defaults to using the Quad9* DNS resolver at 9.9.9.9:53. To change this, you can add an environment variable:
Change Hostnames
Fly apps support an unlimited number of hostnames and SSL certificates. To set one up:
- Add a certificate to your fly app:
- Create a validation CNAME entry:
- Name:
_acme-challenge.example.com.
- Target:
example.com.q8o1.flydns.net
- Make a DNS entry pointing example.com to your Fly app IP
Handle your own TLS
Fly can take care of TLS + HTTPS for you, but it doesn’t have to. If you’d prefer to terminate your own TLS, you can generate your own certificates, store them as encrypted Fly secrets, and tweak the Dockerfile to pull them from your app environment. We’ll happily forward encrypted TCP to your app and let you worry about the rest.
