Validating DNS over TLS

[thebatfink]

Hi, most likely a very simple question but would like to confirm rather than blindly presume. I have been setting up DNS over TLS following the wiki guide. I used cloudflare DNS servers. After setting it up however all the test websites I tried say TLS is not being used (even when DNSSEC was off).

Anyhow I installed tcpdump and using the command in the wiki, watched and saw all the queries go to 1.1.1.1:853 and come back from 1.1.1.1:853.. but they all originate from ports like my.ip:60727. I guess I expected them to be from 853 also, does it look like TLS is being used??

Thanks

 

[RMerlin]

I guess I expected them to be from 853 also,

No, that is normal. The source port will be a random port, just like when you access a web site on port 443, the local port used by your browser will be a random one.

As long you are using remote port 853, then you are definitely using DNS-over-TLS.

 

[thebatfink]

Thanks RMerlin.