Mullvad with custom NextDNS: DNSOverTLS is disabled on th...

Arch Linux Forums

Avidemux crashes without strace / Applications & Desktop Environments how to apply patches with non-linux linends / Newbie Corner Replicating CachyOS on vanilla Arch (or at least getting close) / Arch Discussion What's arch linux GUI package manager ? / Newbie Corner Hibernation failing due to insufficient memory / System Administration profiledef.sh editting question / Installation trying to script kde plasma wallpaper settings / Programming & Scripting Looking for new Audacious package maintainer / Creating & Modifying Packages issues installing arch with LUKS2 encryption / Newbie Corner QEMU PXE booting does not work with OVMF.4m.fd / Applications & Desktop Environments Wired lan regular disconnect / Newbie Corner Need Help setting up ARCH in my G16 G634JZR iwlwifi started failing consistently, trying to determine root cause Windows randomly jumping between monitors after GNOME 50 update No display via DP or HDMI after boot. / Kernel & Hardware how to change acpi platform_profile? / Newbie Corner Linux denied all kernel modules which not loaded right now Use iPhone as Webcam for Arch Linux Video Output Failure on nvidia-580xx-dkms on TTY --> Desktop switch (Page 2) / Kernel & Hardware I was going to rant ..WINE32 Sabotage compliments of Arvind Krishna / Arch Discussion [SOLVED] LUKS drive auto unlocked by TPM when expected not to / Networking, Server, and Protection Hibernate/suspend from X = dark panel; from TTY = works (ASUS G14, hyb (Page 2) / Laptop Issues Headphone jack noise/buzz / Newbie Corner segmentation fault in cc1plus when building CLK / AUR Issues, Discussion & PKGBUILD Requests Console alternative to meld / GNU/Linux Discussion Problem with paru git clone / Newbie Corner XKB questions / Applications & Desktop Environments gnome-keyring-daemon is not working correctly / Applications & Desktop Environments [SOLVED] Steam opens and immediately closes constantly / Newbie Corner Firefox rounded edges on Sway / Applications & Desktop Environments

Archttila · 2026-06-27 · via Arch Linux Forums

Hi everyone,

I'm trying to set up NextDNS as a custom DNS on a server running Mullvad VPN, but systemd-resolved doesn't seem to use DNSOverTLS (DoT) on the WireGuard interface, even though I think my configuration is correct.

Here is what I'm seeing:

mullvad dns get

Custom DNS: yes
Servers:
45.90.28.xx
45.90.30.xx

resolvectl status

Global
Protocols: +LLMNR -mDNS +DNSOverTLS DNSSEC=yes/supported
Link 2 (eth0)
Current Scopes: DNS LLMNR/IPv4
Protocols: +DefaultRoute +LLMNR -mDNS +DNSOverTLS DNSSEC=yes/supported
Link 4 (wg0-mullvad)
Current Scopes: DNS
Protocols: +DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=yes/supported

As you can see, wg0-mullvad has -DNSOverTLS instead of +DNSOverTLS.

Here is my resolved.conf

[Resolve]
DNS=45.90.28.0#mindegy.dns.nextdns.io
DNS=45.90.30.0#mindegy.dns.nextdns.io
DNSOverTLS=yes
DNSSEC=yes
Domains=~.

And the output of resolvectl state for the interfaces:

Server: 45.90.28.0#mindegy.dns.nextdns.io 
                               Type: system
             Verified feature level: TLS+EDNS0+DO
             Possible feature level: TLS+EDNS0+DO
                        DNSSEC Mode: yes
                   DNSSEC Supported: yes
                                          
Server: 45.90.30.0#mindegy.dns.nextdns.io 
                               Type: system
             Verified feature level: n/a
             Possible feature level: TLS+EDNS0+DO
                        DNSSEC Mode: yes

Server: 45.90.28.0#mindegy.dns.nextdns.io 
                               Type: link
                        Interface: wlan0
                  Interface Index: 3
             Verified feature level: TLS+EDNS0+DO
             Possible feature level: TLS+EDNS0+DO
                        DNSSEC Mode: yes
                   DNSSEC Supported: yes
                                          
Server: 45.90.30.0#mindegy.dns.nextdns.io 
                               Type: link
                        Interface: wlan0
                  Interface Index: 3
             Verified feature level: n/a
             Possible feature level: TLS+EDNS0+DO
                        DNSSEC Mode: yes
                   DNSSEC Supported: yes

Server: 45.90.28.xx                
                              Type: link
                         Interface: wg0-mullvad
                   Interface Index: 5
            Verified feature level: UDP+EDNS0+DO
            Possible feature level: UDP+EDNS0+DO
                       DNSSEC Mode: yes
                  DNSSEC Supported: yes
                                    
Server: 45.90.30.xx                
                              Type: link
                         Interface: wg0-mullvad
                   Interface Index: 5
            Verified feature level: n/a
            Possible feature level: TLS+EDNS0+DO
                       DNSSEC Mode: yes
                  DNSSEC Supported: yes

On wg0-mullvad, it falls back to UDP+EDNS0+DO (plain UDP) instead of TLS.

My questions:
1. What could be causing systemd-resolved or Mullvad to strip/ignore DoT on the WireGuard link?
2. Does it even make sense to force DoT inside an already encrypted VPN tunnel (since Mullvad encrypts everything end-to-end to their server anyway)?

Any insights would be highly appreciated!

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Arch Linux Forums