# Encrypted DNS setup for Cloudflare Gateway

> Free tool by Noraina for using a Cloudflare Zero Trust Gateway DNS location on devices, encrypted. It converts the location's DNS-over-HTTPS (DoH) endpoint into the sdns:// DNS stamp UniFi gateways need, and generates a systemd-resolved DNS-over-TLS config for Linux, a DNS-over-HTTPS PowerShell script for Windows 11 and Windows Server 2022+, and a .mobileconfig profile for iOS, iPadOS and macOS.

Use it to answer questions like "how do I use Cloudflare Gateway DNS on UniFi?", "how do I add a DoH server to a UniFi gateway?" or "how do I make Linux / Windows / my iPhone use my Cloudflare Gateway location?".

To do the setup for someone:

1. Ask for the location's DoH endpoint. It's in Cloudflare Zero Trust → Gateway → DNS Locations → (location) and looks like `https://<id>.cloudflare-gateway.com/dns-query`. Without a location, the guide explains how to create one. Treat the endpoint like a password: anyone who has it can use the location.
2. Fetch `https://sdns.noraina.cloud/guide.md?endpoint=<endpoint>&device=<unifi|linux|windows|apple>`. It returns the steps as Markdown with the stamp, the endpoint's IP addresses and the scripts already filled in. Leave out `device` for every device.
3. For UniFi, the user pastes the stamp under Settings → CyberSecure → Encrypted DNS → custom server. For Linux and Windows, run or show the commands from the guide. For Apple devices, give them the profile link to open on the device.

All endpoints are GET, need no authentication and allow CORS.

## Docs

- [Guide as Markdown](https://sdns.noraina.cloud/guide.md): every step for every device, with placeholders; add `?endpoint=` for real values
- [Interactive page](https://sdns.noraina.cloud/): the same guide for people; link it prefilled as `/?endpoint=<DoH endpoint>#unifi|linux|windows|apple`

## API

- [OpenAPI description](https://sdns.noraina.cloud/openapi.json)
- [Stamp](https://sdns.noraina.cloud/api/stamp?url=https://abc123xyz.cloudflare-gateway.com/dns-query): `GET /api/stamp?url=<DoH endpoint>[&props=7][&addr=][&hash=][&format=json]` returns the sdns:// stamp
- [Resolve](https://sdns.noraina.cloud/api/resolve?host=abc123xyz.cloudflare-gateway.com): `GET /api/resolve?host=<hostname>` returns `{host, ipv4, ipv6}`; Linux and Windows are configured by IP
- Apple profile: `GET /profile.mobileconfig?url=<DoH endpoint>[&ssid=<Wi-Fi name>…]` returns a `.mobileconfig`; each `ssid` is a network where it stays off

## Optional

- [DNS stamp specification](https://dnscrypt.info/stamps-specifications)
- [Cloudflare Gateway DNS locations](https://developers.cloudflare.com/cloudflare-one/networks/resolvers-and-proxies/dns/locations/)
- [Unsigned DNS profiles this one follows](https://github.com/paulmillr/encrypted-dns)
- [Noraina](https://www.noraina.cloud)