29.6. Configuring an existing IdM DNS server to use eDNS

Procedure

1. Optional: Verify that your IdM server uses integrated DNS:

   $ ipa server-role-find --role 'DNS server'
   ---------------------
   1 server role matched
   ---------------------
     Server name: server.idm.example.com
     Role name: DNS server
     Role status: enabled
   ----------------------------
   Number of entries returned 1
   ----------------------------

2. Install the ipa-server-encrypted-dns package on your IdM server:

   # dnf install ipa-server-encrypted-dns

3. Update the integrated DNS service to enable DoT and configure DoT policy and forwarders:

   # ipa-dns-install --dns-over-tls --dot-forwarder "<server_ip>#<dns_server_hostname>" --dns-policy enforced -U

   For a complete list of options see the ipa-dns-install(1) man page on your system.

4. Add the dns-over-tls service to the system firewall to open port 853/TCP for DoT traffic:

   # firewall-cmd --add-service=dns-over-tls