.DNS over TLS (DoT) in IdM deployments is available as a Technology Preview Encrypted DNS using DNS over TLS (DoT) is now available as a Technology Preview in Identity Management (IdM) deployments. You can now encrypt all DNS queries and responses between DNS clients and IdM DNS servers. To start using this functionality, install the `ipa-server-encrypted-dns` package on IdM servers and replicas, and the `ipa-client-encrypted-dns` package on IdM clients. Administrators can enable DoT during the installation by using the `--dns-over-tls` option. IdM configures Unbound as a local caching resolver and BIND to receive DoT requests. This functionality is available through the command-line interface (CLI) and non-interactive installations of IdM. The following options were added to installation utilities for IdM servers, replicas, clients, and the integrated DNS service: * `--dot-forwarder` to specify an upstream DoT-enabled DNS server. * `--dns-over-tls-key` and `--dns-over-tls-cert` to configure DoT certificates. * `--dns-policy` to set a DNS security policy to either allow fallback to unencrypted DNS or enforce strict DoT usage. By default, IdM uses the `relaxed` DNS policy, which allows fallback to unencrypted DNS. You can enforce encrypted-only communication by using the new `--dns-policy` option with the `enforced` setting. You can also enable DoT on an existing IdM deployment by reconfiguring the integrated DNS service by using `ipa-dns-install` with the new DoT options. See link: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/installing_identity_management/securing-dns-with-dot-in-idm [Securing DNS with DoT in IdM] for more details.