ScotNet Secure DNSPrivate resolver infrastructure

Configuration guides

Connect an approved device.

Choose the guide for the device or browser you actually use. Menu wording changes between releases, but the endpoint values remain the same.

Approval comes first. A correct client configuration will still fail when the device, ClientID or current source address has not been approved.

Endpoint values

Copy exactly — do not add spaces

DNS over TLS

dns.scott.ovh

Standard port: 853. Android Private DNS expects the hostname only.

DNS over HTTPS

https://dns.scott.ovh/dns-query

Use the complete HTTPS URL where a custom DoH template is requested.

Android Private DNS

System-wide DNS over TLS on supported Android devices.

DoT
  1. Open Settings, then Network & internet or your manufacturer’s equivalent.
  2. Open Private DNS.
  3. Select Private DNS provider hostname.
  4. Enter dns.scott.ovh — no scheme, path or port.
  5. Save. Android validates the TLS connection before accepting the setting.
Mobile-address warning. Source-address approval may stop working when a carrier changes your public address. Android Private DNS cannot supply a username and password.
Verify
Open several sites, then temporarily enter an invalid Private DNS hostname. Android should report that Private DNS cannot connect. Restore dns.scott.ovh afterward.
Undo this configuration
Select Automatic or Off in the same Private DNS screen.

Official Android network settings

Firefox

Browser-only DNS over HTTPS.

DoH
  1. Open Settings, then Privacy & Security.
  2. Find DNS over HTTPS.
  3. Choose the protection level that permits a custom provider.
  4. Enter https://dns.scott.ovh/dns-query.
  5. Save and restart Firefox if requested.
Scope. This changes Firefox lookups only. Other applications continue using the operating-system resolver.
Verify
Open Firefox’s DNS over HTTPS settings again and confirm the ScotNet URL is still selected. Run the real resolver verification check to prove whether this browser's one-use query reached ScotNet DNS.
Undo this configuration
Return DNS over HTTPS to Default protection or Off.

Official Firefox DoH settings

Chrome, Chromium and Edge

Browser-only DNS over HTTPS where custom providers are supported.

DoH
  1. Open the browser’s Privacy and security settings.
  2. Open Security or search settings for Secure DNS.
  3. Enable Use Secure DNS.
  4. Choose a custom provider and enter https://dns.scott.ovh/dns-query.
  5. When strict encrypted-only behaviour is available, do not enable plain-DNS fallback.
Managed devices. Family, workplace or security policies can disable the custom-provider field.
Undo this configuration
Set Secure DNS back to the operating-system provider or turn it off.

Official Chrome security settings

Windows 11

System-wide encrypted DNS requires an approved resolver IP address.

DoH / DoT
  1. Obtain the approved ScotNet resolver IPv4 and/or IPv6 address from the operator. The hostname alone is not enough for adapter configuration.
  2. Open Settings → Network & internet, select the active Wi-Fi or Ethernet connection, then edit DNS server assignment.
  3. Select Manual and enter the approved resolver address.
  4. Select Encrypted only. Where Windows asks for a DoH template, use https://dns.scott.ovh/dns-query.
  5. Save, reconnect the adapter and confirm normal name resolution.
Do not guess the resolver IP. A web-facing address or proxy address may not be the correct DNS server address.
Advanced Windows command-line shape

Run an elevated terminal and replace the placeholders:

netsh dnsclient add encryption server=APPROVED_IP dohtemplate=https://dns.scott.ovh/dns-query autoupgrade=yes udpfallback=no
netsh dnsclient set dnsserver name="Ethernet" source=static address=APPROVED_IP register=primary validate=yes
netsh dnsclient show encryption server=APPROVED_IP
Undo this configuration
netsh dnsclient delete encryption server=APPROVED_IP protocol=doh
netsh dnsclient set dnsserver name="Ethernet" source=dhcp

Use your actual interface name. Restore previous static DNS values instead of DHCP when the machine did not originally use DHCP.

Official Microsoft DNS client commands

iPhone, iPad and Mac

System-wide encrypted DNS is normally delivered through a DNS Settings configuration profile.

DoH / DoT
  1. Request an operator-supplied ScotNet DNS profile after access approval.
  2. Review the profile’s organisation, DNS protocol, hostname and server URL before installation.
  3. Install it using the profile or device-management workflow appropriate to the device.
  4. Confirm the profile appears under VPN, DNS or device-management settings.
No generic profile is published. Access controls and permitted server addresses must match the approved device. Never install a DNS profile from an untrusted source.
Undo this configuration
Remove the ScotNet DNS profile from device-management or profile settings, then reconnect the network.

Official Apple DNS Settings payload guidance

Linux and advanced clients

Use a local DoT-capable resolver or browser-level DoH.

Advanced

For systemd-resolved, obtain the approved resolver IP first. A typical strict DoT configuration is:

[Resolve]
DNS=APPROVED_IP#dns.scott.ovh
DNSOverTLS=yes

Replace APPROVED_IP, save the settings in an appropriate resolved.conf drop-in, restart systemd-resolved, and verify with resolvectl status.

Version support varies. Confirm that your distribution’s systemd build supports server-name validation in the address#server_name form.
Undo this configuration
Remove the ScotNet drop-in, restore the previous DNS settings, then restart systemd-resolved.

Official systemd-resolved configuration

Verification

What can be checked today

Transport configuration

Confirm the saved hostname or URL, verify ordinary DNS resolution, and check that strict modes do not silently fall back to plain DNS.

Authoritative resolver identity test

A website loading successfully does not prove that the browser or operating system used ScotNet DNS. The v1.3 resolver check creates a one-use hostname and confirms whether the query reached ScotNet's resolver-local authority.

Check service statusReport setup trouble