Linux Adds Built-in Encrypted DNS Lookups Through systemd to Shield Browsing Privacy

The Internet Society recently discovered that recent Linux distributions now ship with native support for making DNS queries over TLS. To see how this works in practice, its researchers tested Ubuntu 18.10 on a laptop. This matters because DNS, the Domain Name System, acts as the internet's phonebook: it turns the website names you type into the numeric IP addresses computers use to connect. Normally, those lookups travel across the network in plain, readable text, which means anyone on the path, such as a Wi-Fi provider, an internet service provider or a malicious eavesdropper, can see which sites you are visiting. Sending DNS queries over TLS wraps that phonebook request in the same kind of encryption used for secure websites, hiding your browsing history from prying eyes.

More recent versions of Ubuntu use a special background service for name resolution called systemd-resolved. The full service name is system-resolved.service(8), following the Linux convention for naming system services and their manual pages. This service handles the translation of domain names into addresses, and its configuration file provides a place to enable encrypted DNS. By turning on DNS-over-TLS in that file, users can tell systemd-resolved to use a resolver that speaks TLS, so every name lookup is protected. The Internet Society's blog post points to this configuration file as the key to activating the privacy feature, although it does not detail every step.

DNS-over-TLS works by establishing an encrypted tunnel between your computer and a DNS resolver, the server that answers your name lookup requests. Once the tunnel is in place, your DNS queries are sent inside it, just as HTTPS encrypts web traffic. This prevents outsiders from reading which domain names you request, and it also makes it much harder for an attacker to tamper with the answers, a technique known as DNS spoofing or hijacking. For Linux users, having this built into the operating system removes the need to install extra software: the operating system's own name resolution service can do the encryption. That is a significant step forward for privacy because DNS data is often overlooked even by people who use a VPN or private browsing mode.

The fact that recent Linux distributions include this capability is important for both individuals and businesses. Many servers, cloud instances and workplace computers run Linux, and their DNS queries often travel over networks that are not fully trusted. Encrypting those queries reduces the risk of surveillance, profiling and targeted attacks. Ubuntu 18.10 was only one test; other recent distributions that use systemd also benefit, because the underlying service supports the same encrypted mode. IT teams can configure all Linux machines on a network to use DNS-over-TLS, ensuring consistent privacy across the organisation. However, the protection is only as strong as the resolver you choose: a resolver that keeps logs or sells data undermines the privacy gain, so selecting a trustworthy, no-logs encrypted DNS provider is just as important as turning on the encryption itself.

For Linux users and anyone else who wants to apply these protections beyond a single laptop, a privacy-first encrypted DNS service such as AEU DNS offers DNS-over-TLS and other encrypted DNS options with a no-logs policy, making it easier to keep your name lookups private without building your own resolver. The wider lesson from the Internet Society's test is that DNS privacy is no longer only for experts: the operating system now gives you the switch, and you only need to choose a safe destination for your encrypted queries.