DoH on UniFi — Encrypted DNS via Cloudflare Zero Trust

What I actually wanted was filtering and visibility. Cloudflare Gateway gives you policy control and query logs for every DNS lookup on the network — which sites, which devices, when — and that's the feature set I was after. Encryption was the nice-to-have that came along for the ride: since the queries have to travel to Cloudflare anyway, they may as well travel over HTTPS where the ISP can't read or rewrite them.

The usual way to get this is a local filtering resolver — a Pi-hole or AdGuard Home box that the whole network points at. I'd been down that road and didn't want another always-on machine to maintain, and more to the point, a local resolver is a single point of failure with the worst possible blast radius: when it dies, the internet dies for everyone in the house.

The UniFi gateway is already in the DNS path for every client — so instead of putting a proxy next to it, teach it to speak DoH itself. UniFi's DNS Shield accepts a custom DNS stamp: a single string that encodes the protocol, hostname, and path of a DoH endpoint. Point it at the unique endpoint Zero Trust assigns your DNS location, and the gateway resolves everything through your Gateway policies directly.

The result is the simplest possible chain — gateway to Cloudflare, one hop, nothing in between with its own cache and its own opinions when something doesn't resolve. No container to update, no Pi to reflash, no hardware added to the network at all.

Three steps, no command line. Create a DNS location in the Zero Trust dashboard under Gateway, which assigns it a unique DoH endpoint. Encode that endpoint as a DNS stamp with the stamp calculator — protocol DoH, your hostname, path /dns-query, everything else blank. Paste the stamp into the UniFi console.

# Zero Trust assigns your DNS location an endpoint like
https://your-id.cloudflare-gateway.com/dns-query

# encoded as a stamp, it becomes one string
sdns://AgcAAAAAAAAAAAAhaD...your-id...Ci9kbnMtcXVlcnk

# pasted into UniFi at
Settings > Security > Protection > Encrypted DNS > Custom

Verify from any client with 1.1.1.1/help — it reports whether queries are arriving over DoH — and by watching the query log populate in the Zero Trust dashboard.