How to query for DNS over HTTPS/DNS over TLS using command line?

Question

I'm writing a script that needs to query DNS record with a user specified DNS server. The DNS server may be in any protocol, including UDP, TCP, DNS over HTTPS (DoH), and DNS over TLS (DoT).

I know dig is able to handle DNS for UDP and TCP (with +tcp flag). Is there a way I can use dig or other tool to query DoH and DoT server?

I prefer already existing popular tools like curl so my script would be more portable, but other suggestions are welcomed as well.

Answer 1

I didn't find a single tool for both the purpose, but I did find ways to use them.

There are two ways to query DoH:

# json
curl -H 'accept: application/dns-json' 'https://cloudflare-dns.com/dns-query?name=example.com&type=A' | jq .
# dns wireformat
curl -H 'accept: application/dns-message' 'https://dns.google/dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB'  | hexdump -c

For DoT, you can use kdig tool provided by knot. The command line is similar to dig:

apt-get install knot-dnsutils
# For macOS:
# brew install knot
kdig -d @8.8.8.8 +tls-ca +tls-host=dns.google.com example.com

where the 8.8.8.8 is the pre-resolved address of the tls host (dns.google.com).

---

Update: Here is a tool (https://github.com/ameshkov/dnslookup) that supports all major DNS protocols on its own and is able to produce machine-readable output.

Answer 2

curl has official DoH support since version 7.62.0 (the question is how many of your target endpoints have curl uptodate to this version.)

Use it by utilizing the --doh-url option. Example:

curl --doh-url https://cloudflare-dns.com/dns-query https://www.google.com

See: https://github.com/curl/curl/wiki/DOH-implementation https://daniel.haxx.se/blog/2018/09/06/doh-in-curl/

Answer 3

Dog is a dig alternative written in Rust and supporting DOH/DOT. installation

Examples:

dog -H @https://dns.google/dns-query google.com

dog google.com --tls @dns.google

It can also output as json.

Answer 4

If dig is compiled to support it +tls:

dig @127.0.0.1 google.com +tls

; <<>> DiG 9.17.8 <<>> @127.0.0.1 google.com +tls
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54991
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 065928dae0bd1d28010000005fdd61d904c6723221991bf3 (good)
;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             300     IN      A       172.217.0.238

;; Query time: 1123 msec
;; SERVER: 127.0.0.1**#853**(127.0.0.1) **(TLS)**
;; WHEN: Sat Dec 19 02:13:45 UTC 2020
;; MSG SIZE  rcvd: 83

Answer 5

Besides DoT (as mentioned by other users here), the latest version of dig also supports DoH query by using the +https flag.

+https[=value], +nohttps
    This option indicates whether to use DNS over HTTPS (DoH) when  querying  name
    servers.   When  this  option is in use, the port number defaults to 443.  The
    HTTP POST request mode is used when sending the query.

    If value is specified, it will be used as the HTTP endpoint in the query  URI;
    the  default  is /dns-query. So, for example, dig @example.com +https will use
    the URI https://example.com/dns-query.

Example,

dig @cloudflare-dns.com +https foobar.com

By declaring +https, dig will query the provided DNS server domain (cloudflare-dns.com) with HTTPS on port 443 to the default endpoint /dns-query.

Effectively the above command will send a DoH (POST) request about foobar.com to:

• https://cloudflare-dns.com/dns-query

There are options to switch to GET request, declare a different endpoint and etc. Read the man page of these query options related to DoH:

• +https
• +https-get
• +https-post
• +http-plain
• +http-plain-get
• +http-plain-post

Answer 6

There is q (https://github.com/natesales/q) which supports DNS-over-QUIC as well as DNS-over-TLS and DNS-over-HTTPS. It also supports DNSSEC.

Some examples of queries and responses.

# DOH
$ q --dnssec A AAAA example.com @https://dns.example.com
example.com. 23h57m40s A 127.0.0.1

#DOT
$ q --dnssec A AAAA example.com @tls://dns.example.com
example.com. 23h57m40s A 127.0.0.1
example.com. 23h57m40s RRSIG A 8 2 86400 20210416051959 20210325232537 45150 example.com. N40WYg7CBxSc.....

Answer 7

For DoH (DNS-over-HTTPS):

• Curl has a stand-alone app: github.com/curl/doh to do DoH name resolves and lookups. Shows complete DNS request / response in verbose mode -v.
• Another web client (dohjs.org): github.com/byu-imaal/dohjs/