Tools to investigate how DNS over TLS/HTTPS work / how resolve / if work correctly/ how establish tunnels etc

Question

• DoT DNS over TLS https://www.rfc-editor.org/rfc/rfc7858
• DoH DNS over HTTPs https://www.rfc-editor.org/rfc/rfc8484

(nice explanation: https://blog.cloudflare.com/dns-encryption-explained/ - TL;DR- port tcp/853)

Traditionally for DNS over udp/53 we could use dig to investigate resolution.

I would like to investigate not only resolution, but also quality of encryption layer of connection (i.e. certificate used etc).

Using what tool/tools/command would you recommend investigation of Encrypted DNS resolution (DoT , DoH), including typical dig staff and used encryption certificates? (is there sth better then just combination with wireshark or openssl ?)

Answer 1

You may want to have a look at dog. dog is a command-line DNS client.

From the README:

Protocol options

-U, --udp                Use the DNS protocol over UDP
-T, --tcp                Use the DNS protocol over TCP
-S, --tls                Use the DNS-over-TLS protocol
-H, --https              Use the DNS-over-HTTPS protocol