mutual-tls-dot-server.toml

# This is the server-side of a secure DNS proxy where the server expects the
# client to present a signed certificate it trusts (mutual-TLS). Any query
# received from the client this way, will then be forwarded to Cloudflare via
# DoT by the server.

[resolvers.cloudflare-dot]
address = "1.1.1.1:853"
protocol = "dot"

[listeners.local-dot]
address = ":853"
protocol = "dot"
resolver = "cloudflare-dot"
server-crt = "/path/to/server.crt"
server-key = "/path/to/server.key"
ca = "/path/to/ca.crt"
mutual-tls = true