How to query DNS over HTTPS with dig

An encrypted resolver test should prove more than whether a domain returns an address. dig can send one DNS question through DNS over HTTPS (DoH), so an operator can exercise a specific HTTPS endpoint without changing the computer's system resolver.

Current BIND releases use +https for an HTTP POST request on port 443. Supplying +tls-ca enables certificate-authority validation, while +tls-hostname provides the expected certificate identity when the resolver is addressed by IP.

This test sends only the named query to Cloudflare's public resolver; it does not route other applications through DoH. The resolver can still read the DNS question, and returned addresses, order, TTL, and query time can differ from the sample output.

1. Test the DoH endpoint with a deliberately mismatched TLS identity.

   $ dig @1.1.1.1 example.com A +https=/dns-query +tls-ca +tls-hostname=example.net +time=3 +tries=1
   ;; communications error to 1.1.1.1#443: failure
   
   ; <<>> DiG 9.20.18-1ubuntu2.1-Ubuntu <<>> @1.1.1.1 example.com A +https=/dns-query +tls-ca +tls-hostname=example.net +time=3 +tries=1
   ; (1 server found)
   ;; global options: +cmd
   ;; no servers could be reached

   The failed connection is expected because Cloudflare's certificate does not identify example.net. Disabling +tls-ca would remove this identity check.

2. Send the A-record query to Cloudflare's DoH endpoint with its expected TLS identity.

   $ dig @1.1.1.1 example.com A +https=/dns-query +tls-ca +tls-hostname=cloudflare-dns.com +noall +answer +stats
   example.com.        130 IN  A   104.20.23.154
   example.com.        130 IN  A   172.66.147.243
   ;; Query time: 7 msec
   ;; SERVER: 1.1.1.1#443(1.1.1.1) (HTTPS)
   ;; WHEN: Sun Jul 12 22:03:14 UTC 2026
   ;; MSG SIZE  rcvd: 72

   The answer records prove that the DNS question completed, while the SERVER line identifies 1.1.1.1 on HTTPS port 443. Other query names and record types use the same transport options.