Enabling DNS over TLS on Fedora 42 with systemd-resolved

Recently, I have been exploring how to encrypt my DNS traffic on Fedora 42 using DNS over TLS (DoT). Along the way, I ran into confusing symlinks, missing config files, and a few misconceptions about how Fedora handles DNS under the hood. Here’s everything I learned, condensed into a practical guide for anyone else trying to harden their DNS on Linux.

TL;DR

• Fedora uses systemd-resolved for DNS.
• /etc/resolv.conf is usually a symlink to a stub file—don’t edit it directly.
• Use a drop-in config in /etc/systemd/resolved.conf.d/ to enable DNS over TLS.
• DNS over HTTPS (DoH) is not supported by systemd-resolved.
• Cloudflare and Quad9 are good DNS providers with DoT support.

What I Did

1. Discovered /etc/resolv.conf is a symlink

ls -l /etc/resolv.conf

Expected output:

/etc/resolv.conf -> ../run/systemd/resolve/stub-resolv.conf

This confirms systemd-resolved is managing DNS. Editing this file is useless—it’s managed dynamically:

2. Created a config directory for custom settings

sudo mkdir -p /etc/systemd/resolved.conf.d

Then created a new config file:

sudo nano /etc/systemd/resolved.conf.d/dns-over-tls.conf

3. Configured DNS Over TLS

In that file, I added:

[Resolve]
DNS=1.1.1.1#cloudflare-dns.com 9.9.9.9#dns.quad9.net
DNSOverTLS=yes

Here’s what this does:

• Sets two DoT-enabled resolvers (Cloudflare and Quad9).
• Enforces encrypted DNS transport via TLS.

4. Restarted systemd-resolved

sudo systemctl restart systemd-resolved

5. Verified DoT was working

resolvectl status

Look for:

DNS Over TLS: yes

🎉 Done!

Why DNS over TLS (and not HTTPS)?

While both DNS over TLS (DoT) and DNS over HTTPS (DoH) encrypt DNS traffic to prevent snooping and tampering, there are key differences:

We chose DNS over TLS for this setup because:

• Fedora 42 with systemd-resolved only supports DoT natively.
• DoT is simpler to configure at the system level (no extra proxies).
• DoT separates DNS from other HTTPS traffic, making it easier to monitor/debug.

If you need DoH, you’ll have to install and run an external proxy like cloudflared or dnscrypt-proxy, which adds complexity. Since our goal was a clean, system-integrated solution using what’s already available on Fedora 42, DoT was the right fit.

What I Learned

• systemd-resolved is more powerful than I thought, but poorly documented in some areas.
• The real DNS config lives in /etc/systemd/resolved.conf or resolved.conf.d/ drop-ins.
• The /etc/resolv.conf file is a stub and shouldn’t be edited—it’s managed dynamically.
• DNS over TLS is natively supported. DNS over HTTPS is not (use cloudflared or dnscrypt-proxy for that).

References

• systemd-resolved Arch Wiki
• Fedora System Administrator’s Guide – Networking
• Cloudflare DNS-over-TLS docs
• Quad9 DNS security

Optional Next Steps

• Use cloudflared or dnscrypt-proxy if you want DNS-over-HTTPS.
• Add monitoring with tools like Wireshark to verify encrypted DNS traffic.
• Use DNS Leak Test to ensure nothing leaks to your ISP.

This was a quick little project that I embarked on, if you read this I hope this helped and that it saves you time!