# How to Enable DNS over HTTPS in Docker Containers for InternetIncome

> Secure your InternetIncome Docker containers with DNS over HTTPS. Easily enable encrypted DNS queries by setting USE_DNS_OVER_HTTPS to true in properties.conf.

- Repository: [engageub/internetincome](https://github.com/engageub/internetincome)
- Tags: how-to-guide
- Published: 2026-03-01

---

**Enable DNS over HTTPS in InternetIncome by setting `USE_DNS_OVER_HTTPS=true` in [`properties.conf`](https://github.com/engageub/internetincome/blob/main/properties.conf), which switches the proxy tunnel from `tun2socks` to `tun2proxy` and appends the `--dns over-tcp` flag to encrypt DNS queries.**

The **InternetIncome** script by `engageub/internetincome` orchestrates multiple income-generating applications inside isolated Docker containers. By default, the script configures containers to use standard public DNS resolvers, but you can enable **DNS over HTTPS (DoH)** to encrypt DNS queries and prevent ISP snooping. This guide explains the implementation details found in [`internetIncome.sh`](https://github.com/engageub/internetincome/blob/main/internetIncome.sh) and how to activate the feature.

## Understanding the DNS over HTTPS Implementation

When `USE_DNS_OVER_HTTPS` is enabled, the script fundamentally changes how the proxy tunnel container handles DNS resolution. Instead of using the default `tun2socks` image, the script pulls and runs **`tun2proxy`** (version `v0.7.19`) from `ghcr.io/tun2proxy/tun2proxy`.

The `tun2proxy` container intercepts all DNS queries from application containers and forwards them over HTTPS to upstream resolvers. This is achieved by passing the **`--dns over-tcp`** argument to the container at runtime, which forces DNS resolution through the encrypted tunnel rather than cleartext UDP.

## Configuring DNS over HTTPS in properties.conf

To enable the feature, you must edit the [`properties.conf`](https://github.com/engageub/internetincome/blob/main/properties.conf) file in the repository root. Set the boolean flag to `true` and ensure conflicting options are disabled.

```text

# properties.conf

USE_DNS_OVER_HTTPS=true
USE_SOCKS5_DNS=false

```

The script checks this variable during initialization. If `USE_DNS_OVER_HTTPS` equals `true`, the logic branch starting at line 208 in [`internetIncome.sh`](https://github.com/engageub/internetincome/blob/main/internetIncome.sh) executes, overriding the default tunnel behavior.

## How the Script Implements DNS over HTTPS

The orchestration logic in [`internetIncome.sh`](https://github.com/engageub/internetincome/blob/main/internetIncome.sh) handles image selection, container creation, and DNS option injection through several distinct steps.

### Detecting the Configuration Flag

At lines 208–216, the script evaluates the `USE_DNS_OVER_HTTPS` environment variable. When true, it sets the `TUNNEL_IMAGE` variable to the `tun2proxy` registry path and defines the `DNS_OPTION` string.

```bash
elif [ "$USE_DNS_OVER_HTTPS" = true ]; then
    sudo docker pull ghcr.io/tun2proxy/tun2proxy:v0.7.19
    TUNNEL_IMAGE="ghcr.io/tun2proxy/tun2proxy:v0.7.19"
    DNS_OPTION="--dns over-tcp"

```

### Running the Tunnel Container with DoH

At lines 250–258, the script launches the tunnel container using the variables defined above. The `--dns over-tcp` flag is appended to the container command, ensuring all DNS queries from connected application containers are routed through the HTTPS resolver.

```bash
sudo docker run -d \
  --name tun$(openssl rand -hex 4) \
  --cap-add=NET_ADMIN \
  --restart=always \
  --mount type=bind,source=$(pwd)/resolv.conf,target=/etc/resolv.conf,readonly \
  $TUNNEL_IMAGE $DNS_OPTION

```

### Fallback DNS Configuration

Before any containers start, the script generates a fallback [`resolv.conf`](https://github.com/engageub/internetincome/blob/main/resolv.conf) at lines 46–50. This file contains public DNS servers (8.8.8.8, 1.1.1.1) and is mounted into every container. If the `tun2proxy` container fails or is unreachable, containers can still resolve names using this fallback, preventing startup failures.

## Verifying DNS over HTTPS is Active

To confirm that DNS queries are encrypted, inspect the running tunnel container and test resolution from within an application container.

First, verify the tunnel is using the correct image and flags:

```bash
docker ps --filter "ancestor=ghcr.io/tun2proxy/tun2proxy:v0.7.19" --format "table {{.Names}}\t{{.Command}}"

```

You should see the `--dns over-tcp` argument in the command column.

Next, execute a DNS lookup from inside any running income container (e.g., EarnApp):

```bash
docker exec -it earnapp$(cat containernames.txt | head -n1) sh -c "nslookup cloudflare.com"

```

If the query returns results and the tunnel logs (viewable via `docker logs <tunnel_name>`) show TCP DNS forwarding, DoH is active. The `tun2proxy` image routes these TCP DNS requests over the HTTPS tunnel to the upstream resolver.

## Summary

- **Enable DoH** by setting `USE_DNS_OVER_HTTPS=true` in [`properties.conf`](https://github.com/engageub/internetincome/blob/main/properties.conf) before starting the script.
- **Image switch**: The script replaces the default `tun2socks` tunnel with `ghcr.io/tun2proxy/tun2proxy:v0.7.19` when the flag is enabled.
- **DNS encryption**: The `--dns over-tcp` flag forces DNS queries through the HTTPS tunnel, preventing cleartext UDP leaks.
- **Fallback safety**: A static [`resolv.conf`](https://github.com/engageub/internetincome/blob/main/resolv.conf) (8.8.8.8, 1.1.1.1) is mounted into all containers as a backup if the tunnel fails.
- **Verification**: Check running containers for the `tun2proxy` image and test DNS resolution from within app containers to confirm encryption is active.

## Frequently Asked Questions

### What is the difference between tun2socks and tun2proxy in InternetIncome?

**`tun2socks`** is the default tunnel image used when `USE_DNS_OVER_HTTPS` is disabled or set to `false`. It routes traffic through a SOCKS5 proxy but does not inherently encrypt DNS queries. **`tun2proxy`** is the specialized image pulled when `USE_DNS_OVER_HTTPS=true`; it supports the `--dns over-tcp` flag, which tunnels DNS queries over HTTPS, providing encryption and preventing ISP-based DNS snooping.

### Can I use DNS over HTTPS with SOCKS5 DNS enabled?

**No**, these options are mutually exclusive. The script logic in [`internetIncome.sh`](https://github.com/engageub/internetincome/blob/main/internetIncome.sh) checks `USE_DNS_OVER_HTTPS` first; if set to `true`, it configures the `tun2proxy` container with `--dns over-tcp`. You must set `USE_SOCKS5_DNS=false` in [`properties.conf`](https://github.com/engageub/internetincome/blob/main/properties.conf) to avoid conflicts, as both settings attempt to control DNS resolution behavior within the tunnel container.

### How do I verify that DNS queries are encrypted?

To verify, first confirm the tunnel container is running the correct image with `docker ps` and check that the command includes `--dns over-tcp`. Then, execute `nslookup` or `dig` from within any application container (e.g., `docker exec -it <container_name> nslookup example.com`). If the query succeeds while the tunnel logs show TCP-based DNS forwarding, and no cleartext UDP DNS traffic is visible on port 53, DNS over HTTPS is active.

### What happens if the tun2proxy container fails to start?

If the `tun2proxy` container fails, the InternetIncome script has a **fallback mechanism**. Before launching any containers, it generates a static [`resolv.conf`](https://github.com/engageub/internetincome/blob/main/resolv.conf) containing public DNS servers (8.8.8.8 and 1.1.1.1) and mounts this into every application container. This ensures that even if the encrypted tunnel is unreachable, containers can still resolve domain names and start successfully, though without the privacy benefits of DNS over HTTPS.