Custom DNS over TLS


I have an already set up adguard home public server, I would like then to use my custom DNS over TLS/https/quic but only today I noticed there are only nextdns and cloudflare as options, I find this unbelievable and there must be a way to choose the DNS servers I want
Sadly I didn’t manage to find this
Am I losing something? Thank you all

You’re not losing it. I raised that as a feature request some while ago. Until then, a symlink will do what you need:

root@GL-AXT1800:~# ll /etc/dnscrypt-proxy2/dnscrypt-proxy.toml
lrwxrwxrwx    1 root     root          40 Jul 13 12:41 /etc/dnscrypt-proxy2/dnscrypt-proxy.toml -> dnscrypt-proxy.myDohDnsProvider.usa.toml
1 Like

As first thank you for your input
I have to say I m not using dnscrypt and the only thing I have is the URL
I also tried editing stabby but did not manage… how would I create this sym link not having any file? Thank you
And if I can I understood you use something else instead of adguard may I ask you what?

I use DeCloudUs via DOH (hence dnscrypt-proxy2). 12.00USD/year, non logging by default, unlimited devices, optional per-profile logging. Stubby, DNSCrypt-Proxy, DNSSEC supported. I’ve used Stubby for DOT until moving to DOH.

I can post a conf for you to template from if you wish.

1 Like

oh i’ll see thank you! But for now how can i write my url into a stubby conf :gl_emoji_confused:?

thats all i have in the stubby file on my router

agree this needs to be addressed, editing stubby is not a good solution.

see Slate AX custom DOH/DOT dns servers

1 Like

Thank you for this guide, I understood I have to see the ip from adguard guide but I have a localhost address and a 172.28.xx.xx I think this last one is a private one
Now maybe this happens because my Adghome is dockerized but on my android phone I managed just by putting the URL (no address, no ports), maybe I have to put the public IP address of the vps in stabby and not this one here? :sweat_smile:

Anyway to me is unbelievable this feature is not available nor in glinet Fw nor in luci

Well, it may not be much but here’s a copy of my stubby.yml when I was running DOT. I switched to DOH as it’s harder (if not near impossible) to block than DOT’s requirement of an open port 853 when it comes to hostile networks:

#NOTE: See '/etc/stubby/stubby.yml.default' for original config file and descriptions




tls_query_padding_blocksize: 128

edns_client_subnet_private : 1

round_robin_upstreams: 0

idle_timeout: 60000

  -  0::1@53535


## DeCloudUs Custom DNS Locked IPv4 (USA)
  - address_data:
    tls_port: 853
    tls_auth_name: "[redacted]"

# ## DeCloudUs Custom DNS Locked IPv4 (Germany)
#  - address_data:
#    tls_port: 853
#    tls_auth_name: "[redacted]"

## DeCloudUs Custom DNS Locked IPv6 (Germany)
#  - address_data: 2a01:4f8:13a:250b::187
#    tls_port: 853
#    tls_auth_name: "[redacted]"

Perhaps you should ping @beniamin ; he seems to state having some experience w/ OpenWrt & dockerizing AdGuardHome:

1 Like

Wish I could help, but No real experience with TLS/https/quic.

My AGH was standard DNS. I kept it simple. Upstream was cloudflare.

1 Like

maybe the option would be having both tls and https since sadly android phones support only DoT

they also support DoH but only when google says so (currently only for google and cloudflare)