传统 DNS 使用 udp 53 端口，也可以使用 tcp ，明文传输，安全性和保护用户隐私都做的不好，虽然有一些技术方案如 ：DNSCrypt 。
现在 dns over https DoH 技术成熟起来了，在新版的 Firefox 可以直接启用，chrome 还在实现阶段。
常规-》网络设置-》启用基于 HTTPS 的 DNS: 提供商选 cloudflare 即可。
使用 curl 进行测试下
curl "https://1.0.0.1/dns-query?ct=application/dns-json&name=baidu.com&type=A" -v * Trying 1.0.0.1... * TCP_NODELAY set * Connected to 1.0.0.1 (1.0.0.1) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/cert.pem CApath: none * TLSv1.2 (OUT), TLS handshake, Client hello (1): * TLSv1.2 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (IN), TLS handshake, Server key exchange (12): * TLSv1.2 (IN), TLS handshake, Server finished (14): * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.2 (OUT), TLS handshake, Finished (20): * TLSv1.2 (IN), TLS change cipher, Change cipher spec (1): * TLSv1.2 (IN), TLS handshake, Finished (20): * SSL connection using TLSv1.2 / ECDHE-ECDSA-CHACHA20-POLY1305 * ALPN, server accepted to use h2 * Server certificate: * subject: C=US; ST=California; L=San Francisco; O=Cloudflare, Inc.; CN=cloudflare-dns.com * start date: Jan 11 00:00:00 2021 GMT * expire date: Jan 18 23:59:59 2022 GMT * subjectAltName: host "1.0.0.1" matched cert's IP address! * issuer: C=US; O=DigiCert Inc; CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1 * SSL certificate verify ok. * Using HTTP2, server supports multi-use * Connection state changed (HTTP/2 confirmed) * Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0 * Using Stream ID: 1 (easy handle 0x7f8922810e00) > GET /dns-query?ct=application/dns-json&name=baidu.com&type=A HTTP/2 > Host: 1.0.0.1 > User-Agent: curl/7.64.1 > Accept: */* > * Connection state changed (MAX_CONCURRENT_STREAMS == 256)! < HTTP/2 200 < date: Sun, 06 Jun 2021 02:13:50 GMT < content-type: application/dns-json < content-length: 243 < access-control-allow-origin: * < cf-request-id: 0a80b223110000e7f1b8877000000001 < expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" < server: cloudflare < cf-ray: 65ae1fb1bb01e7f1-LAX < * Connection #0 to host 1.0.0.1 left intact {"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"baidu.com","type":1}],"Answer":[{"name":"baidu.com","type":1,"TTL":65,"data":"39.156.69.79"},{"name":"baidu.com","type":1,"TTL":65,"data":"220.181.38.148"}]}* Closing connection 0
aliyun 也有提供这个服务 http://dns.alidns.com/resolve?name=www.taobao.com.&type=1
经过测试 aliyun 的 DoH 服务也存在DNS 污染问题。
curl "https://1.0.0.1/dns-query?ct=application/dns-json&name=www.google.com&type=A" {"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"www.google.com","type":1}],"Answer":[{"name":"www.google.com","type":1,"TTL":39,"data":"172.217.14.100"}]} curl "http://dns.alidns.com/resolve?name=www.google.com.&type=1" {"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":{"name":"www.google.com.","type":1},"Answer":[{"name":"www.google.com.","TTL":15,"type":1,"data":"162.125.32.6"}]}
思考：DoH 虽然解决了 DNS 污染的问题，但是可用的节点就那么固定几个，除非自建，win10 好像有计划支持 DoH，但是 在不支持的系统上面如 win7 xp ，实际用处比较少，现在绝大多数工作使用浏览器就能搞定，无非就是装个新版浏览器的问题。
非要让整个系统都用上 DoH 而系统又不支持的情况下，只能自行实现一个 本地 DNS server ，上行用 DoH ，下行用传统的 UDP ，确实用处极少，暂无开发计划。