DoT and DoH for JusProgDNS

JusProgDNS can also be used as a parental control filter with “DNS over TLS” (DoT) and “DNS over HTTPS” (DoH) on devices (smartphones, tablets, laptops) and integrates particularly well into networks and systems, especially into MDM systems such as Jamf or Microsoft Intune.

DoH and DoT are also suitable for configuring the JusProg name servers across devices (regardless of the Wi-Fi network used, whether at home or for home schooling) on devices such as iPhones/iPads, Android smartphones and tablets, and Chromebooks. With DoH, it is also possible to secure just a single browser with the parental control filter without affecting internet usage on the rest of the device.

Tip: DoH is used for iOS (iPhone, iPad), DoT for Android (smartphones, tablets).

DNS over HTTPS (DoH)

Please use these DoH entries:

  • Age group: 0 years and over: https://doh0.jusprogdns.com/dns-query
  • Age group: 6 years and over: https://doh6.jusprogdns.com/dns-query
  • Age group 12 years and over: https://doh12.jusprogdns.com/dns-query
  • Age group 16 years and over: https://doh16.jusprogdns.com/dns-query

The standard HTTPS port (443) is used. The implementation must comply with RFC8484 and, essentially, use the Accept header: application/dns-message. See also https://datatracker.ietf.org/doc/html/rfc8484.

Custom settings with DoH / MDM

If you wish to use DoH for your school and for home schooling on, for example, iPads (Android tablets use DoT, see below) – for instance, with MDM control – please contact us. We will then provide you with customised DoH links that assign pupils’ devices to your JusProgDNS account, whilst taking into account your own settings such as whitelists and blocklists. Furthermore, this allows us to provide you with the Premium service, which features more reliable and faster servers, as well as defined access quotas.

Example of a customised DoH link:

https://doh12.jusprogdns.com/kidsname.accountname.passcode

In this case, there is no longer any need to use DynDNS or to register your IP addresses. The protection also works at home on your domestic Wi-Fi network with dynamic IP addresses. Even with the same IP address – for example, across several schools on a single network – different age groups can be configured.

Information on using DoH / MDM for schools and other children’s and youth facilities within the Premium Service is available here. With this service, you can secure iPads used for home schooling with parental control filters.

DNS over TLS (DoT)

DoT is primarily used to ensure parental controls on Android smartphones and tablets. Please use these DoT entries for personal use (without Settings):

  • Age group: 0 years and over: dot0.jusprogdns.com
  • Age group: 6 years and over: dot6.jusprogdns.com
  • Age rating: 12 years and over: dot12.jusprogdns.com
  • Age rating: 16 years and over: dot16.jusprogdns.com

Note: On some networks or in some applications, you may need to specify the port being used. If the subdomain alone does not work, try entering it in the format ‘dot12.jusprogdns.com:853’ (without quotation marks, but with a colon before :853), adjusted to the desired age group.

Technical information: As TLS is only possible with TCP, secure access is no longer possible via UDP. We use the “standard” port 853 defined for DoT here. See also https://datatracker.ietf.org/doc/html/rfc7858.

DoT for schools (MDM) and for private use with customised settings

With JusProg, you can also configure personal settings whilst using DoT for internet filtering. DoT is also the simplest way to secure Android tablets with a parental control filter for private use and for home schooling, both on school premises and when pupils are at home, at friends’ houses or in a café. After registering, you will receive an individual subdomain under the “DoT / MDM” menu item at login.jusprogdns.com for the admin account and for each registered child (i.e. school), following the pattern

  • child-account-passcode-agegroup.dot.jusprogdns.com

Enter this individual subdomain into the ‘Private DNS’ section of your Android smartphone or tablet (under Settings / Connections / Additional connection settings / Private DNS) as the ‘Hostname of the private DNS provider’; this will allow us to map the nameserver queries to your account and the settings for your child. For schools and other organisations, it is best to configure and monitor the “Private DNS” settings via MDM.

Notes

Important: Please always enter the IP addresses appropriate for the age group for name server queries without DoH / DoT, as browsers and other systems have a short timeout for NS queries via DoT/DoH and will then fall back to the unencrypted IP name servers configured in the system – these should also include a parental control function and not be the default IP addresses, e.g. those of the provider, which lack parental control filters. You can find the IP addresses of the JusProg name servers here.

Note: As a general rule, integrating IP addresses for name server queries is preferable, and DoT / DoH is only recommended if you are unable to enter the IP addresses into your system or wish to use DoT / DoH for additional security. Background: Using IP addresses offers better performance (with DoT/DoH, the browser must first resolve the nameserver domain, then establish the TLS connection, and only then does the actual nameserver query take place) and carries no risk of backtracking.

Note when using Mozilla Firefox: Please refer to the information at https://wiki.mozilla.org/Trusted_Recursive_Resolver and, in particular, the section on network.trr.mode. It is essential to set the value to 3 here to prevent a switch to an unprotected nameserver.