DoH service
DoH service: nodes answer DNS queries for your platform site domains over HTTPS (RFC 8484). Hostname, node range, scope, rate limit, auth and upstream settings.
What it does
Nodes provide DNS over HTTPS per RFC 8484 (path /dns-query) and answer queries for your platform site domains and platform CNAME domains. Answers match platform scheduling. Clients just configure it as a DoH server.
When to use it
- Clients or apps resolve your site domains through an encrypted channel, avoiding local DNS hijacking.
- You want answers consistent with platform scheduling, returning the nearest line for the client's network.
Where to configure it
In the console: System, DoH service. Saved settings take effect after the nodes are republished; the top of the page shows how many nodes are in range and how many of them run a DoH-capable version. When it is off, nodes do not load the DoH module.
Settings
| Section | Setting | Default | Description |
|---|---|---|---|
| Service and address | Enable DoH service | Off | Master switch |
| DoH hostname | None | The primary domain of one site on the platform, using that site's bound certificate; nodes hosting that site provide DoH | |
| Port | 443 | Must be an HTTPS port the site already has | |
| Node range | Range | All nodes | All nodes, selected line groups, selected nodes |
| Scope | Included automatically | Nothing to set | Site domains hosted on the node (wildcards included) and platform CNAME domains |
| Additional platform domains | Empty | The domain and its subdomains are added | |
| Accepted query types | A, AAAA, CNAME, HTTPS | SVCB and TXT can be added; ANY, AXFR and similar queries are always refused | |
| Protection | Queries per second per client IP | 20 | Up to 10000 |
| Burst limit | 40 | ||
| Maximum response size | 4096 bytes | 512 to 65535 | |
| Authentication | None | None, path token, Bearer token | |
| Upstream | Upstream addresses | 223.5.5.5, 119.29.29.29 | 1 to 4, IP or IP:port, tried in order |
| Send client subnet to upstream (ECS /24) | On | Lets the upstream answer for the client's network | |
| Query log | Mode | Sampled, 1% | Off, sampled, all; for sampled enter a percentage from 1% to 100% |
When authentication is chosen, saving generates a token automatically and shows it once; ticking "Regenerate token on save" invalidates the old one. The "Service address" at the top of the page is the full address to give clients. The query log is written to doh.jsonl in the node's local log directory and rotates with the node logs.
FAQ
The page says no node version supports DoH
Upgrade the nodes in range first.
Saving says the site was not found or the primary domain is duplicated
The DoH hostname must match exactly one site primary domain on the platform.
What happens for other domains
They get REFUSED and are not forwarded upstream.
Where should the sites that need DoH live
A node answers only for the sites it hosts, so put the sites that need DoH in the same line group as the site that carries the DoH hostname.
Where do I see the query records
The query log is currently in doh.jsonl on the node; the console does not query it yet.