"SERVFAIL)\n"
" +[no]header-only (Send query without a "
"question section)\n"
- " +[no]https[=###] (DNS over HTTPS mode) "
+ " +[no]https[=###] (DNS-over-HTTPS mode) "
"[/]\n"
" +[no]https-get (Use GET instead of "
"default POST method\n"
"(+[no]tcflag))\n"
" +[no]tcp (TCP mode (+[no]vc))\n"
" +timeout=### (Set query timeout) [5]\n"
- " +[no]tls (DNS over TLS mode)\n"
+ " +[no]tls (DNS-over-TLS mode)\n"
" +[no]trace (Trace delegation down "
"from root "
"[+dnssec])\n"
are ignored when this is set.
``+[no]https[=value]``
- This option indicates whether to use DNS-over-HTTPS (DoH) when querying
+ This option indicates whether to use DNS over HTTPS (DoH) when querying
name servers. When this option is in use, the port number defaults to 443.
The HTTP POST request mode is used when sending the query.
5 seconds. An attempt to set ``T`` to less than 1 is silently set to 1.
``+[no]tls``
- This option indicates whether to use DNS-over-TLS (DoT) when querying
+ This option indicates whether to use DNS over TLS (DoT) when querying
name servers. When this option is in use, the port number defaults
to 853.
as well. If an unencrypted connection is desired (for example,
on load-sharing servers behind a reverse proxy), ``tls none`` may be used.
-If a port number is not specified, the default is 53 for standard DNS, 853
-for DNS over TLS, 443 for DNS over HTTPS, and 80 for DNS over unenecrypted
-HTTP. These defaults may be overridden using the ``port``, ``tls-port``,
-``https-port`` and ``http-port`` options.
+If a port number is not specified, the default is 53 for standard DNS,
+853 for DNS over TLS, 443 for DNS over HTTPS, and 80 for
+DNS over HTTP (unencrypted). These defaults may be overridden using the
+``port``, ``tls-port``, ``https-port`` and ``http-port`` options.
Multiple ``listen-on`` statements are allowed. For example:
BIND 9 is built against. For OpenSSL, version 1.1.1 or newer is
required (use ``named -V`` to check).
-By definition, TLS-encrypted traffic (e.g. DNS-over-TLS, DNS-over-HTTPS)
+By definition, TLS-encrypted traffic (e.g. DNS over TLS, DNS over HTTPS)
is opaque to packet sniffers, which makes debugging problems with
encrypted DNS close to impossible. However, Wireshark_ offers a
solution_ to this problem by being able to read key log files. In order
are ignored when this is set.
.TP
.B \fB+[no]https[=value]\fP
-This option indicates whether to use DNS\-over\-HTTPS (DoH) when querying
+This option indicates whether to use DNS over HTTPS (DoH) when querying
name servers. When this option is in use, the port number defaults to 443.
The HTTP POST request mode is used when sending the query.
.sp
5 seconds. An attempt to set \fBT\fP to less than 1 is silently set to 1.
.TP
.B \fB+[no]tls\fP
-This option indicates whether to use DNS\-over\-TLS (DoT) when querying
+This option indicates whether to use DNS over TLS (DoT) when querying
name servers. When this option is in use, the port number defaults
to 853.
.TP