[GH-ISSUE #3336] add ability to force DoQ or DoT for list of configured authoritative servers #1171

New issue

Open

opened 2026-03-16 01:48:01 +03:00 by kerem · 4 comments

kerem commented

2026-03-16 01:48:01 +03:00

Owner

Originally created by @bdaehlie on GitHub (Oct 29, 2025).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/3336

Is your feature request related to a problem? Please describe.
We (ISRG) would like the ability to force Hickory to use DoT or DoQ for a list of configured authoritative servers.

Describe the solution you'd like
We'd like this feature to accept a list of authoritative servers in Hickory's configuration files. Then, whenever Hickory needs to connect to one of these servers for an authoritative query it should use DoT or DoQ with no fallback to a less secure connection.

It may be possible to build this on top of RFC 9539 support. RFC 9539 is, by default, opportunistic, but if Hickory is configured with a list as described above it could require a secure connection rather than do it opportunistically.

Additional context
This is desired for deployment at Let's Encrypt.

Originally created by @bdaehlie on GitHub (Oct 29, 2025). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/3336 **Is your feature request related to a problem? Please describe.** We (ISRG) would like the ability to force Hickory to use DoT or DoQ for a list of configured authoritative servers. **Describe the solution you'd like** We'd like this feature to accept a list of authoritative servers in Hickory's configuration files. Then, whenever Hickory needs to connect to one of these servers for an authoritative query it should use DoT or DoQ with no fallback to a less secure connection. It may be possible to build this on top of RFC 9539 support. RFC 9539 is, by default, opportunistic, but if Hickory is configured with a list as described above it could require a secure connection rather than do it opportunistically. **Additional context** This is desired for deployment at Let's Encrypt.

kerem commented

2026-03-16 01:48:07 +03:00

Author

Owner

@divergentdave commented on GitHub (Oct 29, 2025):

This is related to #2715.

@divergentdave commented on GitHub (Oct 29, 2025): This is related to #2715.

kerem commented

2026-03-16 01:48:12 +03:00

Author

Owner

@marcus0x62 commented on GitHub (Oct 29, 2025):

Do you want this included in #2725?

@marcus0x62 commented on GitHub (Oct 29, 2025): Do you want this included in #2725?

kerem commented

2026-03-16 01:48:17 +03:00

Author

Owner

@bdaehlie commented on GitHub (Oct 30, 2025):

Do you want this included in #2725?

I don't think so. We do want this, but it's not a blocker for using Hickory DNS at Let's Encrypt without this feature.

I would say this is our top priority besides what's on the list in 2725 though. I think some folks from Princeton might look at implementing this in the next couple of months, but I'll let them weigh in here.

@bdaehlie commented on GitHub (Oct 30, 2025): > Do you want this included in [#2725](https://github.com/hickory-dns/hickory-dns/issues/2725)? I don't think so. We do want this, but it's not a blocker for using Hickory DNS at Let's Encrypt without this feature. I would say this is our top priority besides what's on the list in 2725 though. I think some folks from Princeton might look at implementing this in the next couple of months, but I'll let them weigh in here.

kerem commented

2026-03-16 01:48:22 +03:00

Author

Owner

@gcimaszewski commented on GitHub (Nov 1, 2025):

I'm part of the Princeton group @bdaehlie mentioned, thanks for setting up this issue. I'm going to try working on this

@gcimaszewski commented on GitHub (Nov 1, 2025): I'm part of the Princeton group @bdaehlie mentioned, thanks for setting up this issue. I'm going to try working on this