Free DNS over TLS and DNS over HTTPS servers for secure browsing

When we make a query to a DNS server, normally this query is not encrypted, so any user could capture all the information and know in detail what web page we are consulting. Recently, DNS over TLS and DNS over HTTPS have also begun to be used massively, two protocols that allow all DNS queries and responses to be encrypted. Today in RedesZone we are going to indicate which are the best public DNS servers that support DoT and DoH.

DNS over TLS (DoT): what it is and what are the best DNS servers

DNS over TLS is a security protocol that will allow us to encrypt all DNS queries and responses through the TLS protocol, the same TLS protocol that already protects HTTPS connections or that uses VPN software such as OpenVPN. The objective of DoT is to increase the privacy and security of users, and with this protocol it prevents MitM attacks that capture the information, since being encrypted they will not be able to read it, in addition, it also mitigates other attacks such as DNS spoofing and DNS hijacking While the DNS protocol usually uses UDP port 53, DoT uses TCP port 853 to provide information security.

What DNS servers can we use that is compatible with DNS over TLS?

Google: 

8.8.8.8 and 8.8.4.4 for IPv4 networks, and also 2001: 4860: 4860:: 8888 and 2001: 4860: 4860:: 8844 for IPv6 networks. The TLS authentication hostname is «dns.google«. These servers incorporate DNSSEC for added security.

Cloudflare: 

1.1.1.1 and 1.0.0.1 for IPv4 networks, and also 2606: 4700: 4700 :: 1111 and 2606: 4700: 4700 :: 1001 for IPv6 networks. The TLS authentication hostname is «cloudflare-dns.com«. These servers incorporate DNSSEC for added security.

Quad9: 

9.9.9.9 for IPv4 networks, and also 2620: fe:: fe for IPv6 networks. The TLS authentication hostname is «dns.quad9.net«. This server incorporates DNSSEC for greater security.

CleanBrowsing: 

these DNS servers allow us to have web filtering, we have a total of three predefined filters, and depending on each filter we can access or not to different websites.

• Security filtering: these DNS servers filter phishing, malware and malicious domains, it does not block adult content. The DNS servers are 185.228.168.9 and 185.228.169.9 for IPv4 networks, and 2a0d: 2a00: 1 :: 2 and 2a0d: 2a00: 2 :: 2 for IPv6 networks. The TLS authentication hostname is "security-filter-dns.cleanbrowsing.org". These servers incorporate DNSSEC for added security.
• Parental filtering: These DNS servers block adult websites, and also block proxies and VPNs that serve to evade this DNS filtering. Webs like Reddit is also blocked, and by default, it activates the "Safe Mode" of Google, Bing and YouTube to protect the little ones at home. The DNS servers are 185.228.168.168 and 185.228.169.168 for IPv4 networks, and 2a0d: 2a00: 1 :: and 2a0d: 2a00: 2 :: for IPv6 networks. The TLS authentication hostname is "family-filter-dns.cleanbrowsing.org". These servers incorporate DNSSEC for added security.
• Adult filtering: these DNS servers block adult websites, but do not block proxies and VPNs as in the previous case, websites such as Reddit are allowed, but Google and Bing are still preconfigured in "Safe Mode". The DNS servers are 185.228.168.10 and 185.228.169.11 for IPv4 networks, and 2a0d: 2a00: 1 :: 1 and 2a0d: 2a00: 2 :: 1 for IPv6 networks. The TLS authentication hostname is «adult-filter-dns.cleanbrowsing.org«. These servers incorporate DNSSEC for added security.
• You can access the official CleanBrowsing website where you will find all the details of these DNS servers with web filtering.

Adguard: 

This DNS service has a standard DNS and other DNS servers with parental protection.

• Standard DNS: The DNS servers are 176.103.130.130 and 176.103.130.131 for IPv4 networks. The TLS authentication hostname is "dns.adguard.com".
• DNS with parental control: The DNS servers are 176.103.130.132 and 176.103.130.134 for IPv4 networks. The TLS authentication hostname is «dns-family.adguard.com».

NextDNS.io: 

these DNS servers need registration, and we can block different domains in a completely personalized way. We recommend you access the official website to register and use these DNS servers.

DNS.sb: 

The DNS servers are 185.222.222.222 and 185.184.222.222 for IPv4 networks, and 2a09:: and 2a09:: 1 for IPv6 networks. The TLS authentication hostname is "dns.adguard.com". These servers incorporate DNSSEC for greater security and do not keep any type of record.

FAELIX: 

The DNS servers are 46.227.200.54 and 46.227.200.55 for IPv4 networks, and 2a01: 9e00 :: 54 and 2a01: 9e00 :: 55 for IPv6 networks. This DNS service also provides secure DNS service with controls to filter malicious websites, the private DNS servers are 46.227.200.9 and 46.227.203.9 for IPv4 networks. These servers incorporate DNSSEC for greater security and do not keep any type of record.

As you can see, we have a lot of alternatives to make use of DNS over TLS, and also have parental control filters through DNS, and all this for free.

If you don't know anything about DNS so, you can learn about What is DNS?
Related Article: What is Artificial Intelligence? Advantages and Disadvantages of AI

DNS over HTTPS (DoH): what it is and what are the best DNS servers

DNS over HTTPS is a security protocol that will allow us to encrypt all DNS queries and responses through the HTTPS protocol, which makes use of the TLS protocol below. The goal of DoH is to make it easier for users to use a private and secure DNS service, since it is configured directly in our browser, and the latest versions of Mozilla Firefox and Google Chrome currently support this protocol without problems. Depending on the policy chosen in the browser itself, we must always carry out the queries through DoH exclusively, or if it fails, make use of a "normal" DNS resolution without any encryption.

The objective of DoH is the same as that of DoT, that is, to increase the privacy and security of users, preventing MitM attacks that capture the user's private information. It also mitigates other attacks such as DNS spoofing and DNS hijacking. While the DNS protocol usually uses UDP port 53, DoH uses TCP port 443 to provide information security.

What DNS servers can we use that is compatible with DNS over HTTPS?

Google: 

The URL we must enter is «https://dns.google/dns-query«. These servers incorporate DNSSEC for added security.

Cloudflare: 

the URL we must enter is «https://cloudflare-dns.com/dns-query«. These servers incorporate DNSSEC for added security.

Quad9: 

the URL that we will have to enter is «https://dns.quad9.net/dns-query«. These servers incorporate DNSSEC for added security.

CleanBrowsing: 

these DNS servers allow us to have web filtering, we have a total of three predefined filters, and depending on each filter we can access or not to different websites.

• Security filtering: these DNS servers filter phishing, malware and malicious domains, it does not block adult content. The URL that we must enter is "https://doh.cleanbrowsing.org/doh/security-filter/". These servers incorporate DNSSEC for added security. These servers incorporate DNSSEC for added security.
• Parental filtering: These DNS servers block adult websites, and also block proxies and VPNs that serve to evade this DNS filtering. Webs like Reddit is also blocked, and by default, it activates the "Safe Mode" of Google, Bing and YouTube to protect the little ones at home. The URL that we must enter is «https://doh.cleanbrowsing.org/doh/family-filter/«. These servers incorporate DNSSEC for added security.
• Adult filtering: these DNS servers block adult websites, but do not block proxies and VPNs as in the previous case, websites such as Reddit are allowed, but Google and Bing are still preconfigured in "Safe Mode". The URL that we must enter is «https://doh.cleanbrowsing.org/doh/adult-filter/«. These servers incorporate DNSSEC for added security.
• You can access the official CleanBrowsing website where you will find all the details of these DNS servers with web filtering.

Adguard: 

This DNS service has a standard DNS and other DNS servers with parental protection.

• Standard DNS: the URL we must enter is «https://dns.adguard.com/dns-query«.
• DNS with parental control: the URL that we must enter is «https://dns-family.adguard.com/dns-query«.
• NextDNS.io: The URL that we must enter is "https://dns.nextdns.io/ <config_id>", but we must register to use these DNS servers with custom filtering. These servers incorporate DNSSEC for added security.

PowerDNS: 

the URL that we must enter is «https://doh.powerdns.org«.

SecureDNS.eu: 

The URL we must enter is «https://doh.securedns.eu/dns-query«. These servers incorporate DNSSEC for greater security and do not register requests for maximum privacy.

DnsWarden: 

the URL we must enter is «https://doh.dnswarden.com/uncensored» if we want to access without censorship, but if we want to block the ads we must enter «https://doh.dnswarden.com/adblock«. These servers incorporate DNSSEC for greater security and do not register requests for maximum privacy.

Aaflalo.me: 

the URL we must enter is «https://dns.aaflalo.me/dns-query«. These servers incorporate DNSSEC for greater security and block advertising.

Foundation for Applied Privacy: 

the URL we must enter is «https://doh.appliedprivacy.net/query«. These servers incorporate DNSSEC for greater security and block advertising.

Captnemo.in: 

the URL we must enter is «https://doh.captnemo.in/dns-query«. These servers incorporate DNSSEC for added security.

DNS.sb: 

The URL we must enter is «https://doh.dns.sb/dns-query«. These servers incorporate DNSSEC for greater security and do not keep any type of record.

FAELIX: 

the URL we must enter is «https://rdns.faelix.net/«. These servers incorporate DNSSEC for greater security and do not keep any type of record.

doh.li: 

the URL we must enter is «https://doh.li/dns-query«. These servers incorporate DNSSEC for greater security and do not keep any type of record.

As you can see, we have a lot of alternatives to make use of DNS over HTTPS, and also have parental control filters through DNS, and all this for free.