By default, Google DNS over HTTPS is used. It should work for most users (except for People's Republic of China). If you need to modify the default settings, type:

sudo cp /usr/lib/systemd/system/doh-client.service /etc/systemd/system/
sudoedit /etc/systemd/system/doh-client.service

To automatically start DNS-over-HTTPS client as a system service, type:

sudo systemctl start doh-client.service
sudo systemctl enable doh-client.service

Then, modify your DNS settings (usually with NetworkManager) to 127.0.0.1.

To test your configuration, type:

dig www.google.com

If it is OK, you will wee:

;; SERVER: 127.0.0.1#53(127.0.0.1)

Server Configuration

The following is a typical DNS-over-HTTPS architecture:

+--------------+                                +------------------------+
| Application  |                                |  Recursive DNS Server  |
+-------+------+                                +-----------+------------+
        |                                                   |
+-------+------+                                +-----------+------------+
| Client side  |                                |      doh-server        |
| cache (nscd) |                                +-----------+------------+
+-------+------+                                            |
        |         +--------------------------+  +-----------+------------+
+-------+------+  |    HTTP cache server /   |  |   HTTP service muxer   |
|  doh-client  +--+ Content Delivery Network +--+ (Apache, Nginx, Caddy) |
+--------------+  +--------------------------+  +------------------------+

Although DNS-over-HTTPS can work alone, a HTTP service muxer would be useful as you can host DNS-over-HTTPS along with other HTTPS services.

DNSSEC

DNSSEC validation is not built-in. It is highly recommended that you install unbound or bind and pass results for them to validate DNS records.

If you are running a server without anycast, you probably want to enable EDNS0 Client Subnet during your configuring unbound or bind.

Protocol compatibility

DNS-over-HTTPS use a protocol compatible to Google DNS-over-HTTPS, except for absolute expire time is preferred to relative TTL value. Refer to json-dns/response.go for a complete description of the API.

Currently supported features are:

IPv4 / IPv6
EDNS0 large UDP packet (4 KiB by default)
EDNS0 Client Subnet (/24 for IPv4, /48 for IPv6 by default)

License

DNS-over-HTTPS is licensed under GNU Affero General Public License version 3 or later. That means, if you improved DNS-over-HTTPS or fixed a bug, you must disclose your modification to the public, so that others may benefit from your modification, in the same way you receive benefits from this project.

Anyhow, if you have special licensing requirements, as long as you are doing good to the public, feel free to write to me.