Mullvad with custom NextDNS: DNSOverTLS is disabled on the wg0 interfa / Networking, Server, and Protection

Arch Linux Forums

Archttila · 2026-06-27 · via Arch Linux Forums

Hi everyone,

I'm trying to set up NextDNS as a custom DNS on a server running Mullvad VPN, but systemd-resolved doesn't seem to use DNSOverTLS (DoT) on the WireGuard interface, even though I think my configuration is correct.

Here is what I'm seeing:

mullvad dns get

Custom DNS: yes
Servers:
45.90.28.xx
45.90.30.xx

resolvectl status

Global
Protocols: +LLMNR -mDNS +DNSOverTLS DNSSEC=yes/supported
Link 2 (eth0)
Current Scopes: DNS LLMNR/IPv4
Protocols: +DefaultRoute +LLMNR -mDNS +DNSOverTLS DNSSEC=yes/supported
Link 4 (wg0-mullvad)
Current Scopes: DNS
Protocols: +DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=yes/supported

As you can see, wg0-mullvad has -DNSOverTLS instead of +DNSOverTLS.

Here is my resolved.conf

[Resolve]
DNS=45.90.28.0#mindegy.dns.nextdns.io
DNS=45.90.30.0#mindegy.dns.nextdns.io
DNSOverTLS=yes
DNSSEC=yes
Domains=~.

And the output of resolvectl state for the interfaces:

Server: 45.90.28.0#mindegy.dns.nextdns.io 
                               Type: system
             Verified feature level: TLS+EDNS0+DO
             Possible feature level: TLS+EDNS0+DO
                        DNSSEC Mode: yes
                   DNSSEC Supported: yes
                                          
Server: 45.90.30.0#mindegy.dns.nextdns.io 
                               Type: system
             Verified feature level: n/a
             Possible feature level: TLS+EDNS0+DO
                        DNSSEC Mode: yes

Server: 45.90.28.0#mindegy.dns.nextdns.io 
                               Type: link
                        Interface: wlan0
                  Interface Index: 3
             Verified feature level: TLS+EDNS0+DO
             Possible feature level: TLS+EDNS0+DO
                        DNSSEC Mode: yes
                   DNSSEC Supported: yes
                                          
Server: 45.90.30.0#mindegy.dns.nextdns.io 
                               Type: link
                        Interface: wlan0
                  Interface Index: 3
             Verified feature level: n/a
             Possible feature level: TLS+EDNS0+DO
                        DNSSEC Mode: yes
                   DNSSEC Supported: yes

Server: 45.90.28.xx                
                              Type: link
                         Interface: wg0-mullvad
                   Interface Index: 5
            Verified feature level: UDP+EDNS0+DO
            Possible feature level: UDP+EDNS0+DO
                       DNSSEC Mode: yes
                  DNSSEC Supported: yes
                                    
Server: 45.90.30.xx                
                              Type: link
                         Interface: wg0-mullvad
                   Interface Index: 5
            Verified feature level: n/a
            Possible feature level: TLS+EDNS0+DO
                       DNSSEC Mode: yes
                  DNSSEC Supported: yes

On wg0-mullvad, it falls back to UDP+EDNS0+DO (plain UDP) instead of TLS.

My questions:
1. What could be causing systemd-resolved or Mullvad to strip/ignore DoT on the WireGuard link?
2. Does it even make sense to force DoT inside an already encrypted VPN tunnel (since Mullvad encrypts everything end-to-end to their server anyway)?

Any insights would be highly appreciated!

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Arch Linux Forums