It wasn't obvious to me immediately, but the hostname of Google's DNS-over-TLS servers is: dns.google This is important for validating the TLS certificate that

It wasn't obvious to me immediately, but the hostname of Google's DNS-over-TLS servers is: dns.google This is important for validating the TLS certificate that is provided by their servers on 8.8.8.8 and 8.8.4.4 (equivalent to requiring a matching hostname for TLS certificates in web browsers). I see that other commenters in this thread have correctly used this hostname in their examples for CoreDNS and Stubby. Part of a configuration for the Unbound DNS server would look like: forward-zone: name: "." forward-tls-upstream: yes forward-addr: 8.8.8.8@853#dns.google forward-addr: 8.8.4.4@853#dns.google See the configuration guide for using DNS-over-TLS on unbound on the DNS Privacy site: https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Clients#DNSPrivacyClients-Unbound https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Clients#D...