Skip to content


Switch branches/tags

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time


A CoreDNS based service that forwards traditional DNS requests to a DNS-over-TLS upstream server.

The goal for DNSOnward is a low-complexity, easy-to-use project that can be used with one Docker command. If what you need is taking DNS queries and making sure they're encrypted before leaving your network, DNSOnward is likely a good fit.


Run docker run -e SERVICE="cloudflare" -p 53:53 -p 53:53/udp eldridgea/dnsonward

This will start the service using Cloudflare as its upstream DNS server. You can replace "cloudflare" in the line above with either "google" or "quad9" to use their servers instead. This will open up port 53 on your machine and allow it to accept incoming DNS requests. environments WARNING: It is NOT recommended to expose this service to the entire Internet, just in private network environments.

Supported Devices and Architectures

This supports ARMv7 and amd64 architectures so this should work on on most servers as well as Raspberry Pis. I have tested it successfully on my Pi 4 running Raspbian 10. If you're having an issue on other Pi hardware/OS versions please open an issue.


This is CoreDNS-based service intended to be run in environments where traditional DNS requests need to be encrypted before querying an upstream server.

This is intended to be run as a docker container and configured with environment variables.

Onward DNS supports Cloudflare, Google, and Quad9 out of the box with the SERVICE variable, but can also be configured for any DnS-over-TLS (DoT) server.

If you are starting this container you should either supply it with the SERVICE environment variable OR supply it with at least the IP1 and SERVERNAME variables.

Env Variable Function Values
SERVICE Auto configures Onward DNS based on supported services google, cloudflare, and quad9
IP1 A primary upstream DNS IP Address Any IPv4 Address
IP2 A secondary upstream DNS IP Address Any IPv4 Address
SERVERNAME The TLS servername The domain name of the DoT server
CACHE The amount of time DNS responses are cached locally Time in seconds e.g. 100s. Default is 30s

Multi-Arch Builds in Docker

This is pushed to the eldridgea/dnsonward Dockerhub repository using Docker's experimental multi-arch build tool buildx. Building this repo using the standard docker build process should continue to work fine, but to build a multi-arch image yourself in this repo use, make sure you have buildx enabled and run:

docker buildx build --platform linux/amd64,linux/arm/v7 -t eldridgea/dnsonward --push . and replace eldridgea/dnsonward with the repo you'd like to push your build to. You can also add more supported architectures in addition to the amd64 and armv7 ones


A CoreDNS based service that forwards traditional DNS requests to a DNS-over-TLS upstream server







No releases published


No packages published