# DNS over TLS support

**URL:** <https://forums.wyze.com/t/dns-over-tls-support/207829>\
**Category:** Probably Not\
**Tags:** probably-not, video-doorbell-v1\
**Created:** [December 20, 2021, 11:33pm UTC](https://forums.wyze.com/t/dns-over-tls-support/207829 "2021-12-20T23:33:57Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![jamesm113](https://avatars.discourse-cdn.com/v4/letter/j/bcef8e/32.png) [@jamesm113](https://forums.wyze.com/u/jamesm113)\
**Post date:** [December 20, 2021, 11:33pm UTC](https://forums.wyze.com/t/dns-over-tls-support/207829/1 "2021-12-20T23:33:58Z")

</div>

My Wyze doorbell camera will not connect to the internet if my router is setup to use DNS over TLS (DoT).

Please add support to the Wyze doorbell camera for DoT

---

<div class="post-metadata">

**Author:** ![Customer](https://avatars.discourse-cdn.com/v4/letter/c/e19b73/32.png) [@Customer](https://forums.wyze.com/u/Customer)\
**Post date:** [December 20, 2021, 11:40pm UTC](https://forums.wyze.com/t/dns-over-tls-support/207829/2 "2021-12-20T23:40:19Z")

</div>

Or, you know, leave your Wyze and other devices alone and let your router be responsible for converting queries to DNS over TLS. I don’t see much reason to change the cameras?

One example:

> **[DNS-Over-TLS Built-In & Enforced - 1.1.1.1 and the GL.iNet GL-AR750S](https://blog.cloudflare.com/dns-over-tls-built-in/)**
>
> Back in April, I wrote about how it was possible to modify a router to encrypt DNS queries over TLS using Cloudflare's 1.1.1.1 DNS Resolver and a GL.iNet router; the folks at GL.iNet read that blog post and decided to bake DNS-Over-TLS support into...

---

<div class="post-metadata">

**Author:** ![jamesm113](https://avatars.discourse-cdn.com/v4/letter/j/bcef8e/32.png) [@jamesm113](https://forums.wyze.com/u/jamesm113)\
**Post date:** [December 21, 2021, 12:23am UTC](https://forums.wyze.com/t/dns-over-tls-support/207829/3 "2021-12-21T00:23:29Z")

</div>

I basically followed that article. My router is running OpenWRT and I set it up to send all DNS queries over TLS to CloudFlare’s server.

Every single device on my network (and I have dozens of devices) worked fine, except my Wyze doorbell camera.

---

<div class="post-metadata">

**Author:** ![rhousen](https://avatars.discourse-cdn.com/v4/letter/r/db5fbb/32.png) [@rhousen](https://forums.wyze.com/u/rhousen)\
**Post date:** [December 21, 2021, 1:33am UTC](https://forums.wyze.com/t/dns-over-tls-support/207829/4 "2021-12-21T01:33:10Z")

</div>

I had the same problem using the Asus XT8 Mesh Router built in DoT implementation. As soon as I disabled DoT my Wyze Doorbell started showing online and Wyze plug completed its setup.

---

<div class="post-metadata">

**Author:** ![ziemowit](https://avatars.discourse-cdn.com/v4/letter/z/35a633/32.png) [@ziemowit](https://forums.wyze.com/u/ziemowit)\
**Post date:** [March 9, 2022, 3:20pm UTC](https://forums.wyze.com/t/dns-over-tls-support/207829/5 "2022-03-09T15:20:58Z")

</div>

Yes, please fix this issue.

More and more routers like Asus are rolling out DNS over TLS (DoT). Fixing this issue would most likely reduce the amount of returns of the doorbell as support isn’t catching the problem.

I spend some quality time trying to figure out the issue and ended up turning off DoT which I would like to flip on at some point soon.

---

<div class="post-metadata">

**Author:** ![PFFT](https://avatars.discourse-cdn.com/v4/letter/p/b77776/32.png) [@PFFT](https://forums.wyze.com/u/PFFT)\
**Post date:** [March 10, 2022, 9:17pm UTC](https://forums.wyze.com/t/dns-over-tls-support/207829/6 "2022-03-10T21:17:23Z")

</div>

I don’t think that Wyze really pays attention to complaints. Calling support is like talking to a brick wall where they run the same script over and over again.

I agree DNS over TLS causes Wyze cams to drop ‘offline’ from the perspective of the app the thumbnails say offline, but when you click on them you can view the camera, also recording breaks. After doing extensive testing I found the following:

For me, this only breaks if:

- the record is not cached (they have a really low TTL)
- you have blocked devices from getting to 8.8.8.8 to bypass your cache/filtering/privacy settings.

Here’s a cached packet which the cam can process although the TTL is less than 1 minute so the cache will never bee there when the camera needs it:

```auto
; <<>> DiG 9.16.1-Ubuntu <<>> api.wyzecam.com @192.168.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25936
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;api.wyzecam.com. IN	A

;; ANSWER SECTION:
api.wyzecam.com.	19	IN	CNAME	core-prod-cloud-gateway-1340290424.us-west-2.elb.amazonaws.com.
core-prod-cloud-gateway-1340290424.us-west-2.elb.amazonaws.com.	19 IN A	44.228.53.38
core-prod-cloud-gateway-1340290424.us-west-2.elb.amazonaws.com.	19 IN A	52.26.7.89
core-prod-cloud-gateway-1340290424.us-west-2.elb.amazonaws.com.	19 IN A	54.189.218.68
core-prod-cloud-gateway-1340290424.us-west-2.elb.amazonaws.com.	19 IN A	54.189.12.237

;; Query time: 0 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Thu Mar 10 20:43:10 UTC 2022
;; MSG SIZE rcvd: 184

25936+ [1au] A? api.wyzecam.com. (56)
	0x0000: 4500 0054 761b 0000 4011 8089 c0a8 01a3 E..Tv...@.......
	0x0010: c0a8 0101 cb0e 0035 0040 8446 6550 0120 .......5.@.FeP..
	0x0020: 0001 0000 0000 0001 0361 7069 0777 797a .........api.wyz
	0x0030: 6563 616d 0363 6f6d 0000 0100 0100 0029 ecam.com.......)
	0x0040: 1000 0000 0000 000c 000a 0008 6638 a02e ............f8..
	0x0050: a824 d89d .$..
25936 5/0/1 CNAME core-prod-cloud-gateway-1340290424.us-west-2.elb.amazonaws.com., A 44.228.53.38, A 52.26.7.89, A 54.189.218.68, A 54.189.12.237 (184)
	0x0000: 4500 00d4 1bbd 0000 4011 da67 c0a8 0101 E.......@..g....
	0x0010: c0a8 01a3 0035 cb0e 00c0 c268 6550 8180 .....5.....heP..
	0x0020: 0001 0005 0000 0001 0361 7069 0777 797a .........api.wyz
	0x0030: 6563 616d 0363 6f6d 0000 0100 01c0 0c00 ecam.com........
	0x0040: 0500 0100 0000 1300 4022 636f 7265 2d70 ........@"core-p
	0x0050: 726f 642d 636c 6f75 642d 6761 7465 7761 rod-cloud-gatewa
	0x0060: 792d 3133 3430 3239 3034 3234 0975 732d y-1340290424.us-
	0x0070: 7765 7374 2d32 0365 6c62 0961 6d61 7a6f west-2.elb.amazo
	0x0080: 6e61 7773 0363 6f6d 00c0 2d00 0100 0100 naws.com..-.....
	0x0090: 0000 1300 042c e435 26c0 2d00 0100 0100 .....,.5&.-.....
	0x00a0: 0000 1300 0434 1a07 59c0 2d00 0100 0100 .....4..Y.-.....
	0x00b0: 0000 1300 0436 bdda 44c0 2d00 0100 0100 .....6..D.-.....
	0x00c0: 0000 1300 0436 bd0c ed00 0029 0500 0000 .....6.....)....
	0x00d0: 0000 0000 ....

```

And here’s a packet that is not cached, that is a new response via DNS over TLS from 1.1.1.1 you can see the packet is much bigger (447 vs 184) because instead of summarizing all 4 IP’s for the discovered CNAME record, it lists the CNAME 4 times with the IP after each occurrence. The camera doesn’t process this properly even though it is a proper DNS response that is processed just fine from other devices.

```auto
; <<>> DiG 9.16.1-Ubuntu <<>> api.wyzecam.com @192.168.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28450
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;api.wyzecam.com. IN	A

;; ANSWER SECTION:
api.wyzecam.com.	30	IN	CNAME	core-prod-cloud-gateway-1340290424.us-west-2.elb.amazonaws.com.
core-prod-cloud-gateway-1340290424.us-west-2.elb.amazonaws.com.	30 IN A	54.189.12.237
core-prod-cloud-gateway-1340290424.us-west-2.elb.amazonaws.com.	30 IN A	54.189.218.68
core-prod-cloud-gateway-1340290424.us-west-2.elb.amazonaws.com.	30 IN A	52.26.7.89
core-prod-cloud-gateway-1340290424.us-west-2.elb.amazonaws.com.	30 IN A	44.228.53.38

;; Query time: 28 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Thu Mar 10 20:42:58 UTC 2022
;; MSG SIZE rcvd: 447

28450+ [1au] A? api.wyzecam.com. (56)
	0x0000: 4500 0054 7421 0000 4011 8283 c0a8 01a3 E..Tt!..@.......
	0x0010: c0a8 0101 dfe1 0035 0040 8446 6f22 0120 .......5.@.Fo"..
	0x0020: 0001 0000 0000 0001 0361 7069 0777 797a .........api.wyz
	0x0030: 6563 616d 0363 6f6d 0000 0100 0100 0029 ecam.com.......)
	0x0040: 1000 0000 0000 000c 000a 0008 4f01 8e77 ............O..w
	0x0050: 9708 c16d ...m
28450 5/0/1 CNAME core-prod-cloud-gateway-1340290424.us-west-2.elb.amazonaws.com., A 54.189.12.237, A 54.189.218.68, A 52.26.7.89, A 44.228.53.38 (447)
	0x0000: 4500 01db 099e 0000 4011 eb7f c0a8 0101 E.......@.......
	0x0010: c0a8 01a3 0035 dfe1 01c7 863f 6f22 8180 .....5.....?o"..
	0x0020: 0001 0005 0000 0001 0361 7069 0777 797a .........api.wyz
	0x0030: 6563 616d 0363 6f6d 0000 0100 0103 6170 ecam.com......ap
	0x0040: 6907 7779 7a65 6361 6d03 636f 6d00 0005 i.wyzecam.com...
	0x0050: 0001 0000 001e 0040 2263 6f72 652d 7072 .......@"core-pr
	0x0060: 6f64 2d63 6c6f 7564 2d67 6174 6577 6179 od-cloud-gateway
	0x0070: 2d31 3334 3032 3930 3432 3409 7573 2d77 -1340290424.us-w
	0x0080: 6573 742d 3203 656c 6209 616d 617a 6f6e est-2.elb.amazon
	0x0090: 6177 7303 636f 6d00 2263 6f72 652d 7072 aws.com."core-pr
	0x00a0: 6f64 2d63 6c6f 7564 2d67 6174 6577 6179 od-cloud-gateway
	0x00b0: 2d31 3334 3032 3930 3432 3409 7573 2d77 -1340290424.us-w
	0x00c0: 6573 742d 3203 656c 6209 616d 617a 6f6e est-2.elb.amazon
	0x00d0: 6177 7303 636f 6d00 0001 0001 0000 001e aws.com.........
	0x00e0: 0004 36bd 0ced 2263 6f72 652d 7072 6f64 ..6..."core-prod
	0x00f0: 2d63 6c6f 7564 2d67 6174 6577 6179 2d31 -cloud-gateway-1
	0x0100: 3334 3032 3930 3432 3409 7573 2d77 6573 340290424.us-wes
	0x0110: 742d 3203 656c 6209 616d 617a 6f6e 6177 t-2.elb.amazonaw
	0x0120: 7303 636f 6d00 0001 0001 0000 001e 0004 s.com...........
	0x0130: 36bd da44 2263 6f72 652d 7072 6f64 2d63 6..D"core-prod-c
	0x0140: 6c6f 7564 2d67 6174 6577 6179 2d31 3334 loud-gateway-134
	0x0150: 3032 3930 3432 3409 7573 2d77 6573 742d 0290424.us-west-
	0x0160: 3203 656c 6209 616d 617a 6f6e 6177 7303 2.elb.amazonaws.
	0x0170: 636f 6d00 0001 0001 0000 001e 0004 341a com...........4.
	0x0180: 0759 2263 6f72 652d 7072 6f64 2d63 6c6f .Y"core-prod-clo
	0x0190: 7564 2d67 6174 6577 6179 2d31 3334 3032 ud-gateway-13402
	0x01a0: 3930 3432 3409 7573 2d77 6573 742d 3203 90424.us-west-2.
	0x01b0: 656c 6209 616d 617a 6f6e 6177 7303 636f elb.amazonaws.co
	0x01c0: 6d00 0001 0001 0000 001e 0004 2ce4 3526 m...........,.5&
	0x01d0: 0000 2904 d000 0000 0000 00 ..)........

```

Seriously Wyze, I appreciate your products are cheap, but at least make them follow standards! Fix your DNS library so that these larger responses work and don’t take your devices offline! A lot of people are moving to DoT and also blocking generic public resolvers.

---

<div class="post-metadata">

**Author:** ![PFFT](https://avatars.discourse-cdn.com/v4/letter/p/b77776/32.png) [@PFFT](https://forums.wyze.com/u/PFFT)\
**Post date:** [March 10, 2022, 9:48pm UTC](https://forums.wyze.com/t/dns-over-tls-support/207829/7 "2022-03-10T21:48:32Z")

</div>

The OP says they are using their router… Wyze has a serious bug in reading responses from such routers as they tend to contain some extra data, which is still within the DNS RFC and valid. With many devices on my network, Wyze is the only device that has a problem with it. I’ve added details for Wyze to review (not that they will) below.

---

<div class="post-metadata">

**Author:** ![krossphaded](https://avatars.discourse-cdn.com/v4/letter/k/7cd45c/32.png) [@krossphaded](https://forums.wyze.com/u/krossphaded)\
**Post date:** [August 15, 2022, 7:15pm UTC](https://forums.wyze.com/t/dns-over-tls-support/207829/8 "2022-08-15T19:15:31Z")

</div>

After having issues with my cams and bulbs, I’ve come across this thread and was able to resolve my issue.

Turning off DNS-over-TLS fixed all my devices, I’d also like to use DNS-over-TLS as extra network security.

Please allow us to use DNS-over-TLS Wyze, thank you.

---

<div class="post-metadata">

**Author:** ![DannyT](https://avatars.discourse-cdn.com/v4/letter/d/779978/32.png) [@DannyT](https://forums.wyze.com/u/DannyT)\
**Post date:** [September 15, 2022, 12:47am UTC](https://forums.wyze.com/t/dns-over-tls-support/207829/9 "2022-09-15T00:47:42Z")

</div>

I have the same issue with DNS over TLS on my ASUS router. Out of 28 devices Wyze cameras are the only ones that fail. When I turn off DoT they work properly. Please fix this so your customers can be more secure on the internet. Is there some information that you are secretly collecting that DoT blocks/breaks?

---

<div class="post-metadata">

**Author:** ![DroidST](https://avatars.discourse-cdn.com/v4/letter/d/51bf81/32.png) [@DroidST](https://forums.wyze.com/u/DroidST)\
**Post date:** [October 1, 2022, 10:42pm UTC](https://forums.wyze.com/t/dns-over-tls-support/207829/10 "2022-10-01T22:42:44Z")

</div>

Same here using a Asus RT- AX86U and Cam v2’s with DoT enabled, recording to cloud seems to be a problem with router’s DoT enabled, have to disable DoT to even add a Cam v2.

Cam v3’s work as expected with DoT enabled in the Router.

Wyze Wired Doorbell, Wyze Cam Outdoor and the bulbs are a no go with DoT enabled in the router.

Disabling DoT and all is good.

Would like to have DoT enabled in the Router.

Thank You

---

<div class="post-metadata">

**Author:** ![maxnl](https://avatars.discourse-cdn.com/v4/letter/m/b782af/32.png) [@maxnl](https://forums.wyze.com/u/maxnl)\
**Post date:** [October 3, 2022, 3:25am UTC](https://forums.wyze.com/t/dns-over-tls-support/207829/11 "2022-10-03T03:25:46Z")

</div>

To those of you using ASUS routers, in LAN settings you can add a DHCP reservation for your camera and include a specific DNS IP for the specific device.

I was able to enable DoT on the router for everything being forwarded through the router, and have just the camera bypass the router and DoT.

Not the best case scenario, but far from the worst.

Also discovered the Hue HDMI Sync box also has this same issue, though the Hue bridge does not.

---

<div class="post-metadata">

**Author:** ![DroidST](https://avatars.discourse-cdn.com/v4/letter/d/51bf81/32.png) [@DroidST](https://forums.wyze.com/u/DroidST)\
**Post date:** [October 3, 2022, 3:43am UTC](https://forums.wyze.com/t/dns-over-tls-support/207829/12 "2022-10-03T03:43:39Z")

</div>

Here is where this originated

> **[Release - ASUS RT-AX86 Series(RT-AX86U/RT-AX86S) Firmware version...](https://www.snbforums.com/threads/asus-rt-ax86-series-rt-ax86u-rt-ax86s-firmware-version-3-0-0-4-388-20566.81117/page-3#post-793180)**
>
> Is that what you had set it to before the update?
> Default is 20 minutes.
> 
> Quite frankly, I don’t know! I had only just bought the router the day before the current release….and had only just set it up with the beta. The only settings that I had...

I will be testing this soon

---

<div class="post-metadata">

**Author:** ![maxnl](https://avatars.discourse-cdn.com/v4/letter/m/b782af/32.png) [@maxnl](https://forums.wyze.com/u/maxnl)\
**Post date:** [October 3, 2022, 4:18am UTC](https://forums.wyze.com/t/dns-over-tls-support/207829/13 "2022-10-03T04:18:34Z")

</div>

I’ve had mine setup this way for months. It’s not a new feature on the ASUS router. Just happened to see this thread and thought I’d offer the suggestion.

---

<div class="post-metadata">

**Author:** ![DroidST](https://avatars.discourse-cdn.com/v4/letter/d/51bf81/32.png) [@DroidST](https://forums.wyze.com/u/DroidST)\
**Post date:** [October 4, 2022, 6:53am UTC](https://forums.wyze.com/t/dns-over-tls-support/207829/14 "2022-10-04T06:53:30Z")

</div>

For several Asus Routers, there are **three** work-around options. I am using **Option #2** from the Thread below which is different work-around from the one above - allows you to keep the devices on Guest Network 1. Just requires using the Asus Router App.

> **[Solved - Work-around for Wyze Devices with issues when Router has...](https://www.snbforums.com/threads/work-around-for-wyze-devices-with-issues-when-router-has-dns-over-tls-dot-enabled.81163/)**
>
> Wyze Devices with connection / recording issues when DNS-over-TLS (DoT) is enabled in the Router
> Wyze Cam v2
> Wyze Cam Outdoor
> Wyze Wired Doorbell
> Wyze Bulbs
> 
> Cam v3's, see me comment below.
> 
> Issues reported on the Wyze Forum (Wishlist) - Those having...

Wyze should fix the issue in the device though!

---

<div class="post-metadata">

**Author:** ![rhousen](https://avatars.discourse-cdn.com/v4/letter/r/db5fbb/32.png) [@rhousen](https://forums.wyze.com/u/rhousen)\
**Post date:** [October 8, 2022, 12:28am UTC](https://forums.wyze.com/t/dns-over-tls-support/207829/15 "2022-10-08T00:28:04Z")

</div>

I’m also successfully using option 2.