DNS over HTTPS (DoH)

Obtain DoT/DoH endpoints

1. Go to Alibaba Cloud DNS - HTTPDNS.

2. On the Access Configuration tab, select Method 3: DoT/DoH-based access.

3. DoT/DoH supports two integration methods: short address and custom encrypted address.

   Important

   For enhanced security, Use Encrypted Address.

4. Click Add an encrypted URL and enter the custom portion to generate your integration address.

5. Turn on the switch to enable the encrypted address.

   Warning

   • If you decide to stop using DoH to access HTTPDNS, turn off the switch.

   • Use service suspension with caution. Suspending the service downgrades your account to a free user: billing stops, console reports are hidden, and other features are disabled. Your HTTPDNS service is no longer covered by an SLA and becomes subject to throttling and DNS query rejections.

   • You can restart the service after suspension. Restarting restores the original configuration and resumes billing.

Configure DoH in Chrome

Example DoH endpoint: https://5***4-2h*****ynx3tls.alidns.com/dns-query.

The following steps use Chrome to demonstrate DoH configuration.

1. Open Chrome and go to Settings.

   

2. Search for "DNS" and expand the Security section in the results.

   

3. Under Advanced, enable Use secure DNS, select Custom, and enter https://5***4-2h*****ynx3tls.alidns.com/dns-query.

Developer integration

Generate DoH HTTP requests per RFC 8484 and send them to your DoH endpoint.

DoH supports both GET and POST methods. With POST, the DNS query is sent in the HTTP request body. With GET, the "dns" parameter carries the base64url-encoded DNS request.

Code examples

To query via GET: base64url-encode the DNS binary message, append it as the "dns" parameter to the DoH URL, and send the HTTP request.

• Python example — query alibaba.com via DoH:

  import dns.message
  import requests
  import base64
  import json
  
  doh_url = "https://5***4-2h*****ynx3tls.alidns.com/dns-query"
  domain = "alibaba.com"
  rr = "A"
  result = []
  
  message = dns.message.make_query(domain, rr)
  dns_req = base64.urlsafe_b64encode(message.to_wire()).decode("UTF8").rstrip("=")
  r = requests.get(doh_url + "?dns=" + dns_req,
                   headers={"Content-type": "application/dns-message"})
  for answer in dns.message.from_wire(r.content).answer:
      dns = answer.to_text().split()
      result.append({"Query": dns[0], "TTL": dns[1], "RR": dns[3], "Answer": dns[4]})
      print(json.dumps(result))

  Sample result:

  $ python test_doh.py
  [{"Answer": "106.11.XXX.XXX", "Query": "alibaba.com.", "RR": "A", "TTL": "133"}]

• Go example — query alibaba.com via DoH:

  package main
  
  import (
          "encoding/base64"
          "fmt"
          "github.com/miekg/dns"
          "io/ioutil"
          "net/http"
          "os"
  )
  
  func main() {
         query := dns.Msg{}
         query.SetQuestion("www.taobao.com.", dns.TypeA)
         msg, _ := query.Pack()
         b64 := base64.RawURLEncoding.EncodeToString(msg)
         resp, err := http.Get("https://5***4-2h*****ynx3tls.alidns.com/dns-query?dns=" + b64)
         if err != nil {
              fmt.Printf("Send query error, err:%v\n", err)
              os.Exit(1)
         }
         defer resp.Body.Close()
         bodyBytes, _ := ioutil.ReadAll(resp.Body)
         response := dns.Msg{}
         response.Unpack(bodyBytes)
         fmt.Printf("Dns answer is :%v\n", response.String())
  }

  Sample result:

  Sent Get query https://dns.alidns.com/dns-query?dns=xzEBAAABAAAAAAAAA3d3dwZ0YW9iYW8DY29tAAABAAE
  Dns answer is :;; opcode: QUERY, status: NOERROR, id: 5***3
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
  
  ;; QUESTION SECTION:
  ;www.taobao.com.        IN       A
  
  ;; ANSWER SECTION:
  www.taobao.com. 15      IN      CNAME   www.taobao.com.danuoyi.tbcache.com.
  www.taobao.com.danuoyi.tbcache.com.     15      IN      A       221.229.XXX.XXX
  www.taobao.com.danuoyi.tbcache.com.     15      IN      A       221.229.XXX.XXX
  
  ;; ADDITIONAL SECTION:
  
  ;; OPT PSEUDOSECTION:
  ; EDNS: version 0; flags: ; udp: 4096