Versions Compared


  • This line was added.
  • This line was removed.
  • Formatting was changed.


Table of Contents

Servers supporting DNS-over-TLS

The following servers are configured to support TLS on port 1021 and STARTTLS on port 53 for testing purposes.

Open resolver hosted by NLNetLabs:

  • NLNetLabs is kindly hosting an open resolver (running Unbound):
    • IP address: and 2a04:b900:0:100::38
    • The server key file can be obtained by contacting

Authoritative servers

  • The authoritative servers for are running a patched version of NSD:
    • IP address: and 2a04:b900:0:100::37

Authoritative test server hosted by Verisign Labs:

  • Verisign Labs are kindly hosting a test zone on a server (running a patched version of NSD):
    • The zone is named and it has A, AAAA, and TXT records for names from 'A' to 'Z'. 

    • The IP address of the server is currently

    • Server key file is available to download here: nsd.key

    • The zone is signed

    • This server also supports TCP fast open


How to Decode TLS packets in Wireshark

If you want to decode the DNS packets in Wireshark (use 1.12.1 or later) to get support TLSv1.2