diff --git a/cmd/ipfs/dnsresolve_test.go b/cmd/ipfs/dnsresolve_test.go
index 7c0404523a9..fcba5d69702 100644
--- a/cmd/ipfs/dnsresolve_test.go
+++ b/cmd/ipfs/dnsresolve_test.go
@@ -72,4 +72,3 @@ func TestApiEndpointResolveDNSNoResults(t *testing.T) {
 		t.Errorf("expected error not thrown; actual: %v", err)
 	}
 }
-
diff --git a/core/commands/dns.go b/core/commands/dns.go
index 43c5f3d78bf..42a7c98c1a2 100644
--- a/core/commands/dns.go
+++ b/core/commands/dns.go
@@ -61,9 +61,14 @@ The resolver can recursively resolve:
 		cmds.BoolOption(dnsRecursiveOptionName, "r", "Resolve until the result is not a DNS link.").WithDefault(true),
 	},
 	Run: func(req *cmds.Request, res cmds.ResponseEmitter, env cmds.Environment) error {
+		node, err := cmdenv.GetNode(env)
+		if err != nil {
+			return err
+		}
+
 		recursive, _ := req.Options[dnsRecursiveOptionName].(bool)
 		name := req.Arguments[0]
-		resolver := namesys.NewDNSResolver()
+		resolver := namesys.NewDNSResolver(node.DNSResolver.LookupTXT)
 
 		var routing []nsopts.ResolveOpt
 		if !recursive {
diff --git a/core/commands/swarm.go b/core/commands/swarm.go
index ad0526a25ec..b82a95630dc 100644
--- a/core/commands/swarm.go
+++ b/core/commands/swarm.go
@@ -360,6 +360,11 @@ ipfs swarm connect /ip4/104.131.131.82/tcp/4001/p2p/QmaCpDMGvV2BGHeYERUEnRQAwe3N
 		cmds.StringArg("address", true, true, "Address of peer to connect to.").EnableStdin(),
 	},
 	Run: func(req *cmds.Request, res cmds.ResponseEmitter, env cmds.Environment) error {
+		node, err := cmdenv.GetNode(env)
+		if err != nil {
+			return err
+		}
+
 		api, err := cmdenv.GetApi(env, req)
 		if err != nil {
 			return err
@@ -367,7 +372,7 @@ ipfs swarm connect /ip4/104.131.131.82/tcp/4001/p2p/QmaCpDMGvV2BGHeYERUEnRQAwe3N
 
 		addrs := req.Arguments
 
-		pis, err := parseAddresses(req.Context, addrs)
+		pis, err := parseAddresses(req.Context, addrs, node.DNSResolver)
 		if err != nil {
 			return err
 		}
@@ -408,12 +413,17 @@ it will reconnect.
 		cmds.StringArg("address", true, true, "Address of peer to disconnect from.").EnableStdin(),
 	},
 	Run: func(req *cmds.Request, res cmds.ResponseEmitter, env cmds.Environment) error {
+		node, err := cmdenv.GetNode(env)
+		if err != nil {
+			return err
+		}
+
 		api, err := cmdenv.GetApi(env, req)
 		if err != nil {
 			return err
 		}
 
-		addrs, err := parseAddresses(req.Context, req.Arguments)
+		addrs, err := parseAddresses(req.Context, req.Arguments, node.DNSResolver)
 		if err != nil {
 			return err
 		}
@@ -453,9 +463,9 @@ it will reconnect.
 
 // parseAddresses is a function that takes in a slice of string peer addresses
 // (multiaddr + peerid) and returns a slice of properly constructed peers
-func parseAddresses(ctx context.Context, addrs []string) ([]peer.AddrInfo, error) {
+func parseAddresses(ctx context.Context, addrs []string, rslv *madns.Resolver) ([]peer.AddrInfo, error) {
 	// resolve addresses
-	maddrs, err := resolveAddresses(ctx, addrs)
+	maddrs, err := resolveAddresses(ctx, addrs, rslv)
 	if err != nil {
 		return nil, err
 	}
@@ -464,7 +474,7 @@ func parseAddresses(ctx context.Context, addrs []string) ([]peer.AddrInfo, error
 }
 
 // resolveAddresses resolves addresses parallelly
-func resolveAddresses(ctx context.Context, addrs []string) ([]ma.Multiaddr, error) {
+func resolveAddresses(ctx context.Context, addrs []string, rslv *madns.Resolver) ([]ma.Multiaddr, error) {
 	ctx, cancel := context.WithTimeout(ctx, dnsResolveTimeout)
 	defer cancel()
 
@@ -488,7 +498,7 @@ func resolveAddresses(ctx context.Context, addrs []string) ([]ma.Multiaddr, erro
 		wg.Add(1)
 		go func(maddr ma.Multiaddr) {
 			defer wg.Done()
-			raddrs, err := madns.Resolve(ctx, maddr)
+			raddrs, err := rslv.Resolve(ctx, maddr)
 			if err != nil {
 				resolveErrC <- err
 				return
diff --git a/core/core.go b/core/core.go
index 7c8737a6a41..75fc95ff7d8 100644
--- a/core/core.go
+++ b/core/core.go
@@ -40,6 +40,7 @@ import (
 	"github.com/libp2p/go-libp2p/p2p/discovery"
 	p2pbhost "github.com/libp2p/go-libp2p/p2p/host/basic"
 	ma "github.com/multiformats/go-multiaddr"
+	madns "github.com/multiformats/go-multiaddr-dns"
 
 	"github.com/ipfs/go-ipfs/core/bootstrap"
 	"github.com/ipfs/go-ipfs/core/node"
@@ -88,6 +89,7 @@ type IpfsNode struct {
 	Filters       *ma.Filters             `optional:"true"`
 	Bootstrapper  io.Closer               `optional:"true"` // the periodic bootstrapper
 	Routing       routing.Routing         `optional:"true"` // the routing system. recommend ipfs-dht
+	DNSResolver   *madns.Resolver         // the DNS resolver
 	Exchange      exchange.Interface      // the block exchange + strategy (bitswap)
 	Namesys       namesys.NameSystem      // the name system, resolves paths to hashes
 	Provider      provider.System         // the value provider system
diff --git a/core/coreapi/coreapi.go b/core/coreapi/coreapi.go
index 672b426456f..f8c165a0cd3 100644
--- a/core/coreapi/coreapi.go
+++ b/core/coreapi/coreapi.go
@@ -36,6 +36,7 @@ import (
 	routing "github.com/libp2p/go-libp2p-core/routing"
 	pubsub "github.com/libp2p/go-libp2p-pubsub"
 	record "github.com/libp2p/go-libp2p-record"
+	madns "github.com/multiformats/go-multiaddr-dns"
 
 	"github.com/ipfs/go-ipfs/core"
 	"github.com/ipfs/go-ipfs/core/node"
@@ -62,8 +63,9 @@ type CoreAPI struct {
 	recordValidator record.Validator
 	exchange        exchange.Interface
 
-	namesys namesys.NameSystem
-	routing routing.Routing
+	namesys     namesys.NameSystem
+	routing     routing.Routing
+	dnsResolver *madns.Resolver
 
 	provider provider.System
 
@@ -174,6 +176,7 @@ func (api *CoreAPI) WithOptions(opts ...options.ApiOption) (coreiface.CoreAPI, e
 		recordValidator: n.RecordValidator,
 		exchange:        n.Exchange,
 		routing:         n.Routing,
+		dnsResolver:     n.DNSResolver,
 
 		provider: n.Provider,
 
@@ -212,7 +215,15 @@ func (api *CoreAPI) WithOptions(opts ...options.ApiOption) (coreiface.CoreAPI, e
 		}
 
 		subApi.routing = offlineroute.NewOfflineRouter(subApi.repo.Datastore(), subApi.recordValidator)
-		subApi.namesys = namesys.NewNameSystem(subApi.routing, subApi.repo.Datastore(), cs)
+
+		subApi.namesys, err = namesys.NewNameSystem(subApi.routing,
+			namesys.WithDatastore(subApi.repo.Datastore()),
+			namesys.WithDNSResolver(subApi.dnsResolver),
+			namesys.WithCache(cs))
+		if err != nil {
+			return nil, fmt.Errorf("error constructing namesys: %w", err)
+		}
+
 		subApi.provider = provider.NewOfflineProvider()
 
 		subApi.peerstore = nil
diff --git a/core/coreapi/name.go b/core/coreapi/name.go
index babb7c4a8b7..b007ccd7d5c 100644
--- a/core/coreapi/name.go
+++ b/core/coreapi/name.go
@@ -93,9 +93,13 @@ func (api *NameAPI) Search(ctx context.Context, name string, opts ...caopts.Name
 	}
 
 	var resolver namesys.Resolver = api.namesys
-
 	if !options.Cache {
-		resolver = namesys.NewNameSystem(api.routing, api.repo.Datastore(), 0)
+		resolver, err = namesys.NewNameSystem(api.routing,
+			namesys.WithDatastore(api.repo.Datastore()),
+			namesys.WithDNSResolver(api.dnsResolver))
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	if !strings.HasPrefix(name, "/ipns/") {
diff --git a/core/node/dns.go b/core/node/dns.go
new file mode 100644
index 00000000000..1aafbf107a4
--- /dev/null
+++ b/core/node/dns.go
@@ -0,0 +1,81 @@
+package node
+
+import (
+	"fmt"
+	"strings"
+
+	config "github.com/ipfs/go-ipfs-config"
+	doh "github.com/libp2p/go-doh-resolver"
+	madns "github.com/multiformats/go-multiaddr-dns"
+
+	"github.com/miekg/dns"
+)
+
+var defaultResolvers = map[string]string{
+	"eth.":    "https://resolver.cloudflare-eth.com/dns-query",
+	"crypto.": "https://resolver.cloudflare-eth.com/dns-query",
+}
+
+func newResolver(url string) (madns.BasicResolver, error) {
+	if !strings.HasPrefix(url, "https://") {
+		return nil, fmt.Errorf("invalid resolver url: %s", url)
+	}
+
+	return doh.NewResolver(url), nil
+}
+
+func DNSResolver(cfg *config.Config) (*madns.Resolver, error) {
+	var opts []madns.Option
+	var err error
+
+	domains := make(map[string]struct{})           // to track overriden default resolvers
+	rslvrs := make(map[string]madns.BasicResolver) // to reuse resolvers for the same URL
+
+	for domain, url := range cfg.DNS.Resolvers {
+		if domain != "." && !dns.IsFqdn(domain) {
+			return nil, fmt.Errorf("invalid domain %s; must be FQDN", domain)
+		}
+
+		domains[domain] = struct{}{}
+		if url == "" {
+			// allow overriding of implicit defaults with the default resolver
+			continue
+		}
+
+		rslv, ok := rslvrs[url]
+		if !ok {
+			rslv, err = newResolver(url)
+			if err != nil {
+				return nil, fmt.Errorf("bad resolver for %s: %w", domain, err)
+			}
+			rslvrs[url] = rslv
+		}
+
+		if domain != "." {
+			opts = append(opts, madns.WithDomainResolver(domain, rslv))
+		} else {
+			opts = append(opts, madns.WithDefaultResolver(rslv))
+		}
+	}
+
+	// fill in defaults if not overriden by the user
+	for domain, url := range defaultResolvers {
+		_, ok := domains[domain]
+		if ok {
+			continue
+		}
+
+		rslv, ok := rslvrs[url]
+		if !ok {
+			rslv, err = newResolver(url)
+			if err != nil {
+				return nil, fmt.Errorf("bad resolver for %s: %w", domain, err)
+			}
+			rslvrs[url] = rslv
+		}
+
+		opts = append(opts, madns.WithDomainResolver(domain, rslv))
+	}
+
+	return madns.NewResolver(opts...)
+}
diff --git a/core/node/groups.go b/core/node/groups.go
index 90245ba0517..6863043396c 100644
--- a/core/node/groups.go
+++ b/core/node/groups.go
@@ -30,6 +30,7 @@ var BaseLibP2P = fx.Options(
 	fx.Provide(libp2p.PNet),
 	fx.Provide(libp2p.ConnectionManager),
 	fx.Provide(libp2p.Host),
+	fx.Provide(libp2p.MultiaddrResolver),
 
 	fx.Provide(libp2p.DiscoveryHandler),
 
@@ -264,6 +265,7 @@ func Online(bcfg *BuildCfg, cfg *config.Config) fx.Option {
 	return fx.Options(
 		fx.Provide(OnlineExchange(shouldBitswapProvide)),
 		maybeProvide(Graphsync, cfg.Experimental.GraphsyncEnabled),
+		fx.Provide(DNSResolver),
 		fx.Provide(Namesys(ipnsCacheSize)),
 		fx.Provide(Peering),
 		PeerWith(cfg.Peering.Peers...),
@@ -281,6 +283,7 @@ func Online(bcfg *BuildCfg, cfg *config.Config) fx.Option {
 func Offline(cfg *config.Config) fx.Option {
 	return fx.Options(
 		fx.Provide(offline.Exchange),
+		fx.Provide(DNSResolver),
 		fx.Provide(Namesys(0)),
 		fx.Provide(offroute.NewOfflineRouter),
 		OfflineProviders(cfg.Experimental.StrategicProviding, cfg.Reprovider.Strategy, cfg.Reprovider.Interval),
diff --git a/core/node/ipns.go b/core/node/ipns.go
index 4b2c1738923..a178ee3321e 100644
--- a/core/node/ipns.go
+++ b/core/node/ipns.go
@@ -10,6 +10,7 @@ import (
 	"github.com/libp2p/go-libp2p-core/peerstore"
 	"github.com/libp2p/go-libp2p-core/routing"
 	"github.com/libp2p/go-libp2p-record"
+	madns "github.com/multiformats/go-multiaddr-dns"
 
 	"github.com/ipfs/go-ipfs/repo"
 	"github.com/ipfs/go-namesys"
@@ -27,9 +28,18 @@ func RecordValidator(ps peerstore.Peerstore) record.Validator {
 }
 
 // Namesys creates new name system
-func Namesys(cacheSize int) func(rt routing.Routing, repo repo.Repo) (namesys.NameSystem, error) {
-	return func(rt routing.Routing, repo repo.Repo) (namesys.NameSystem, error) {
-		return namesys.NewNameSystem(rt, repo.Datastore(), cacheSize), nil
+func Namesys(cacheSize int) func(rt routing.Routing, rslv *madns.Resolver, repo repo.Repo) (namesys.NameSystem, error) {
+	return func(rt routing.Routing, rslv *madns.Resolver, repo repo.Repo) (namesys.NameSystem, error) {
+		opts := []namesys.Option{
+			namesys.WithDatastore(repo.Datastore()),
+			namesys.WithDNSResolver(rslv),
+		}
+
+		if cacheSize > 0 {
+			opts = append(opts, namesys.WithCache(cacheSize))
+		}
+
+		return namesys.NewNameSystem(rt, opts...)
 	}
 }
 
diff --git a/core/node/libp2p/dns.go b/core/node/libp2p/dns.go
new file mode 100644
index 00000000000..1c56a2c0a87
--- /dev/null
+++ b/core/node/libp2p/dns.go
@@ -0,0 +1,11 @@
+package libp2p
+
+import (
+	"github.com/libp2p/go-libp2p"
+	madns "github.com/multiformats/go-multiaddr-dns"
+)
+
+func MultiaddrResolver(rslv *madns.Resolver) (opts Libp2pOpts, err error) {
+	opts.Opts = append(opts.Opts, libp2p.MultiaddrResolver(rslv))
+	return opts, nil
+}
diff --git a/docs/config.md b/docs/config.md
index ef1ff5477f2..e41c8b1414c 100644
--- a/docs/config.md
+++ b/docs/config.md
@@ -79,7 +79,7 @@ documented in `ipfs config profile --help`.
     enabled block-level garbage collection), you plan on storing very little data in
     your IPFS node, and disk usage is more critical than performance, consider using
     flatfs.
-  - This datastore uses up to several gigabytes of memory. 
+  - This datastore uses up to several gigabytes of memory.
 
   This profile may only be applied when first initializing the node.
 
@@ -218,6 +218,8 @@ does (e.g, `"1d2h4m40.01s"`).
           - [`Swarm.Transports.Network.QUIC`](#swarmtransportsnetworkquic)
           - [`Swarm.Transports.Network.Websocket`](#swarmtransportsnetworkwebsocket)
           - [`Swarm.Transports.Network.Relay`](#swarmtransportsnetworkrelay)
+- [`DNS`](#dns)
+    - [`DNS.Resolvers`](#dnsresolvers)
 
 ## `Addresses`
 
@@ -608,7 +610,7 @@ Examples:
 
 Array of paths that should be exposed on the hostname.
 
-Example: 
+Example:
 ```json
 {
   "Gateway": {
@@ -692,7 +694,8 @@ If additional config is provided for those hostnames, it will be merged on top o
 }
 ```
 
-It is also possible to remove a default by setting it to `null`.  
+It is also possible to remove a default by setting it to `null`.
+
 For example, to disable subdomain gateway on `localhost`
 and make that hostname act the same as `127.0.0.1`:
 
@@ -713,14 +716,20 @@ Below is a list of the most common public gateway setups.
        }
      }'
    ```
-   **Backward-compatible:** this feature enables automatic redirects from content paths to subdomains:  
-   `http://dweb.link/ipfs/{cid}` → `http://{cid}.ipfs.dweb.link`  
-   **X-Forwarded-Proto:** if you run go-ipfs behind a reverse proxy that provides TLS, make it add a `X-Forwarded-Proto: https` HTTP header to ensure users are redirected to `https://`, not `http://`. It will also ensure DNSLink names are inlined to fit in a single DNS label, so they work fine with a wildcart TLS cert ([details](https://github.com/ipfs/in-web-browsers/issues/169)). The NGINX directive is `proxy_set_header X-Forwarded-Proto "https";`.:    
-   `http://dweb.link/ipfs/{cid}` → `https://{cid}.ipfs.dweb.link`  
-   `http://dweb.link/ipns/your-dnslink.site.example.com` → `https://your--dnslink-site-example-com.ipfs.dweb.link`  
-   **X-Forwarded-Host:** we also support `X-Forwarded-Host: example.com` if you want to override subdomain gateway host from the original request:
-   `http://dweb.link/ipfs/{cid}` → `http://{cid}.ipfs.example.com`
+   - **Backward-compatible:** this feature enables automatic redirects from content paths to subdomains:
    
+     `http://dweb.link/ipfs/{cid}` → `http://{cid}.ipfs.dweb.link`
+     
+   - **X-Forwarded-Proto:** if you run go-ipfs behind a reverse proxy that provides TLS, make it add a `X-Forwarded-Proto: https` HTTP header to ensure users are redirected to `https://`, not `http://`. It will also ensure DNSLink names are inlined to fit in a single DNS label, so they work fine with a wildcart TLS cert ([details](https://github.com/ipfs/in-web-browsers/issues/169)). The NGINX directive is `proxy_set_header X-Forwarded-Proto "https";`.:
+  
+     `http://dweb.link/ipfs/{cid}` → `https://{cid}.ipfs.dweb.link`
+     
+     `http://dweb.link/ipns/your-dnslink.site.example.com` → `https://your--dnslink-site-example-com.ipfs.dweb.link`
+     
+   - **X-Forwarded-Host:** we also support `X-Forwarded-Host: example.com` if you want to override subdomain gateway host from the original request:
+   
+     `http://dweb.link/ipfs/{cid}` → `http://{cid}.ipfs.example.com`
+
 
 * Public [path gateway](https://docs.ipfs.io/how-to/address-ipfs-on-web/#path-gateway) at `http://ipfs.io/ipfs/{cid}` (no Origin separation)
    ```console
@@ -738,13 +747,12 @@ Below is a list of the most common public gateway setups.
   ```
   * Note that `NoDNSLink: false` is the default (it works out of the box unless set to `true` manually)
 
-* Hardened, site-specific [DNSLink gateway](https://docs.ipfs.io/how-to/address-ipfs-on-web/#dnslink-gateway).  
-  Disable fetching of remote data (`NoFetch: true`)
-  and resolving DNSLink at unknown hostnames (`NoDNSLink: true`).
+* Hardened, site-specific [DNSLink gateway](https://docs.ipfs.io/how-to/address-ipfs-on-web/#dnslink-gateway).
+
+  Disable fetching of remote data (`NoFetch: true`) and resolving DNSLink at unknown hostnames (`NoDNSLink: true`).
   Then, enable DNSLink gateway only for the specific hostname (for which data
   is already present on the node), without exposing any content-addressing `Paths`:
-      "NoFetch": true,
-      "NoDNSLink": true,
+  
    ```console
    $ ipfs config --json Gateway.NoFetch true
    $ ipfs config --json Gateway.NoDNSLink true
@@ -898,7 +906,7 @@ Type: `bool`
 
 ###### `Pinning.RemoteServices: Policies.MFS.PinName`
 
-Optional name to use for a remote pin that represents the MFS root CID.  
+Optional name to use for a remote pin that represents the MFS root CID.
 When left empty, a default name will be generated.
 
 Default: `"policy/{PeerID}/mfs"`, e.g. `"policy/12.../mfs"`
@@ -907,7 +915,7 @@ Type: `string`
 
 ###### `Pinning.RemoteServices: Policies.MFS.RepinInterval`
 
-Defines how often (at most) the pin request should be sent to the remote service.  
+Defines how often (at most) the pin request should be sent to the remote service.
 If left empty, the default interval will be used. Values lower than `1m` will be ignored.
 
 Default: `"5m"`
@@ -927,7 +935,7 @@ Sets the default router used by pubsub to route messages to peers. This can be o
   connected peers. This router is extremely inefficient but _very_ reliable.
 * `"gossipsub"` - [gossipsub][] is a more advanced routing algorithm that will
   build an overlay mesh from a subset of the links in the network.
-  
+
 Default: `"gossipsub"`
 
 Type: `string` (one of `"floodsub"`, `"gossipsub"`, or `""` (apply default))
@@ -1035,7 +1043,7 @@ Tells reprovider what should be announced. Valid strategies are:
   - "all" - announce all stored data
   - "pinned" - only announce pinned data
   - "roots" - only announce directly pinned keys and root keys of recursive pins
-  
+
 Default: all
 
 Type: `string` (or unset for the default)
@@ -1070,7 +1078,7 @@ public internet (e.g., it's not behind a firewall).
 To force a specific DHT mode, client or server, set `Routing.Type` to
 `dhtclient` or `dhtserver` respectively. Please do not set this to `dhtserver`
 unless you're sure your node is reachable from the public network.
-  
+
 **Example:**
 
 ```json
@@ -1079,8 +1087,8 @@ unless you're sure your node is reachable from the public network.
     "Type": "dhtclient"
   }
 }
-```  
-  
+```
+
 Default: dht
 
 Type: `string` (or unset for the default)
@@ -1294,7 +1302,7 @@ Type: `flag`
 
 Listen Addresses:
 * /ip4/0.0.0.0/tcp/4001 (default)
-* /ip6/::/tcp/4001 (default) 
+* /ip6/::/tcp/4001 (default)
 
 #### `Swarm.Transports.Network.Websocket`
 
@@ -1423,3 +1431,44 @@ other IPFS and libp2p implementations. Unlike Yamux:
 Default: `200`
 
 Type: `priority`
+
+## `DNS`
+
+Options for configuring DNS resolution for [DNSLink](https://docs.ipfs.io/concepts/dnslink/) and `/dns*` [Multiaddrs](https://github.com/multiformats/multiaddr/).
+
+## `DNS.Resolvers`
+
+Map of [FQDNs](https://en.wikipedia.org/wiki/Fully_qualified_domain_name) to custom resolver URLs.
+
+This allows for overriding the default DNS resolver provided by the operating system,
+and using different resolvers per domain or TLD (including ones from alternative, non-ICANN naming systems).
+
+Example:
+```json
+{
+  "DNS": {
+    "Resolvers": {
+      "eth.": "https://eth.link/dns-query",
+      "crypto.": "https://resolver.unstoppable.io/dns-query",
+      "libre.": "https://ns1.iriseden.fr/dns-query",
+      ".": "https://doh-ch.blahdns.com:4443/dns-query"
+    }
+  }
+}
+```
+
+Be mindful that:
+- Currently only `https://` URLs for [DNS over HTTPS (DoH)](https://en.wikipedia.org/wiki/DNS_over_HTTPS) endpoints are supported as values.
+- The default catch-all resolver is the cleartext one provided by your operating system. It can be overriden by adding a DoH entry for the DNS root indicated by  `.` as illustrated above.
+- Out-of-the-box support for selected decentralized TLDs relies on a [centralized service which is provided on best-effort basis](https://www.cloudflare.com/distributed-web-gateway-terms/). The implicit DoH resolvers are:
+  ```json
+  {
+    "eth.": "https://resolver.cloudflare-eth.com/dns-query",
+    "crypto.": "https://resolver.cloudflare-eth.com/dns-query
+  }
+  ```
+  To get all the benefits of a decentralized naming system we strongly suggest setting DoH endpoint to an empty string and running own decentralized resolver as catch-all one on localhost.
+
+Default: `{}`
+
+Type: `object[string -> string]`
diff --git a/go.mod b/go.mod
index 2a93b083335..14310541058 100644
--- a/go.mod
+++ b/go.mod
@@ -29,7 +29,7 @@ require (
 	github.com/ipfs/go-ipfs-blockstore v0.1.4
 	github.com/ipfs/go-ipfs-chunker v0.0.5
 	github.com/ipfs/go-ipfs-cmds v0.6.0
-	github.com/ipfs/go-ipfs-config v0.12.0
+	github.com/ipfs/go-ipfs-config v0.13.0
 	github.com/ipfs/go-ipfs-exchange-interface v0.0.1
 	github.com/ipfs/go-ipfs-exchange-offline v0.0.1
 	github.com/ipfs/go-ipfs-files v0.0.8
@@ -48,7 +48,7 @@ require (
 	github.com/ipfs/go-metrics-interface v0.0.1
 	github.com/ipfs/go-metrics-prometheus v0.0.2
 	github.com/ipfs/go-mfs v0.1.2
-	github.com/ipfs/go-namesys v0.1.1
+	github.com/ipfs/go-namesys v0.2.0
 	github.com/ipfs/go-path v0.0.9
 	github.com/ipfs/go-pinning-service-http-client v0.1.0
 	github.com/ipfs/go-unixfs v0.2.5
@@ -59,6 +59,7 @@ require (
 	github.com/jbenet/go-random v0.0.0-20190219211222-123a90aedc0c
 	github.com/jbenet/go-temp-err-catcher v0.1.0
 	github.com/jbenet/goprocess v0.1.4
+	github.com/libp2p/go-doh-resolver v0.3.0
 	github.com/libp2p/go-libp2p v0.14.0
 	github.com/libp2p/go-libp2p-circuit v0.4.0
 	github.com/libp2p/go-libp2p-connmgr v0.2.4
@@ -84,6 +85,7 @@ require (
 	github.com/libp2p/go-tcp-transport v0.2.1
 	github.com/libp2p/go-ws-transport v0.4.0
 	github.com/lucas-clemente/quic-go v0.19.3
+	github.com/miekg/dns v1.1.41
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/multiformats/go-multiaddr v0.3.1
 	github.com/multiformats/go-multiaddr-dns v0.3.1
diff --git a/go.sum b/go.sum
index 13650c2d02a..6b1ebc171f5 100644
--- a/go.sum
+++ b/go.sum
@@ -76,8 +76,6 @@ github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kB
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
-github.com/bren2010/proquint v0.0.0-20160323162903-38337c27106d h1:QgeLLoPD3kRVmeu/1al9iIpIANMi9O1zXFm8BnYGCJg=
-github.com/bren2010/proquint v0.0.0-20160323162903-38337c27106d/go.mod h1:Jbj8eKecMNwf0KFI75skSUZqMB4UCRcndUScVBTWyUI=
 github.com/btcsuite/btcd v0.0.0-20190213025234-306aecffea32/go.mod h1:DrZx5ec/dmnfpw9KyYoQyYo7d0KEvTkk/5M/vbZjAr8=
 github.com/btcsuite/btcd v0.0.0-20190523000118-16327141da8c/go.mod h1:3J08xEfcugPacsc34/LKRU2yO7YmuT8yt28J8k2+rrI=
 github.com/btcsuite/btcd v0.0.0-20190605094302-a0d1e3e36d50/go.mod h1:3J08xEfcugPacsc34/LKRU2yO7YmuT8yt28J8k2+rrI=
@@ -410,8 +408,8 @@ github.com/ipfs/go-ipfs-chunker v0.0.5 h1:ojCf7HV/m+uS2vhUGWcogIIxiO5ubl5O57Q7Na
 github.com/ipfs/go-ipfs-chunker v0.0.5/go.mod h1:jhgdF8vxRHycr00k13FM8Y0E+6BoalYeobXmUyTreP8=
 github.com/ipfs/go-ipfs-cmds v0.6.0 h1:yAxdowQZzoFKjcLI08sXVNnqVj3jnABbf9smrPQmBsw=
 github.com/ipfs/go-ipfs-cmds v0.6.0/go.mod h1:ZgYiWVnCk43ChwoH8hAmI1IRbuVtq3GSTHwtRB/Kqhk=
-github.com/ipfs/go-ipfs-config v0.12.0 h1:wxqN3ohBlis1EkhkzIKuF+XLx4YNn9rNpiSOYw3DFZc=
-github.com/ipfs/go-ipfs-config v0.12.0/go.mod h1:Ei/FLgHGTdPyqCPK0oPCwGTe8VSnsjJjx7HZqUb6Ry0=
+github.com/ipfs/go-ipfs-config v0.13.0 h1:ZH3dTmkVR9TTFBIbfWnFNC1JdwHbj8F0ryiaIFo7U/o=
+github.com/ipfs/go-ipfs-config v0.13.0/go.mod h1:Ei/FLgHGTdPyqCPK0oPCwGTe8VSnsjJjx7HZqUb6Ry0=
 github.com/ipfs/go-ipfs-delay v0.0.0-20181109222059-70721b86a9a8/go.mod h1:8SP1YXK1M1kXuc4KJZINY3TQQ03J2rwBG9QfXmbRPrw=
 github.com/ipfs/go-ipfs-delay v0.0.1 h1:r/UXYyRcddO6thwOnhiznIAiSvxMECGgtv35Xs1IeRQ=
 github.com/ipfs/go-ipfs-delay v0.0.1/go.mod h1:8SP1YXK1M1kXuc4KJZINY3TQQ03J2rwBG9QfXmbRPrw=
@@ -482,8 +480,8 @@ github.com/ipfs/go-metrics-prometheus v0.0.2 h1:9i2iljLg12S78OhC6UAiXi176xvQGiZa
 github.com/ipfs/go-metrics-prometheus v0.0.2/go.mod h1:ELLU99AQQNi+zX6GCGm2lAgnzdSH3u5UVlCdqSXnEks=
 github.com/ipfs/go-mfs v0.1.2 h1:DlelNSmH+yz/Riy0RjPKlooPg0KML4lXGdLw7uZkfAg=
 github.com/ipfs/go-mfs v0.1.2/go.mod h1:T1QBiZPEpkPLzDqEJLNnbK55BVKVlNi2a+gVm4diFo0=
-github.com/ipfs/go-namesys v0.1.1 h1:HwJWd1h0Z4oALjdOz8aP/38SHgyOfh0MUUaanvEUUn8=
-github.com/ipfs/go-namesys v0.1.1/go.mod h1:JITpuwDgYYh84sXxw8bQXY3aTlEdyJqkbzvE12YzXgM=
+github.com/ipfs/go-namesys v0.2.0 h1:QoxOsYl5sufEqE/kP7v6b9IbOTxM4LO88GGmiXWPekI=
+github.com/ipfs/go-namesys v0.2.0/go.mod h1:j1ttlrLy7/NhtwrXOqwMty749Fe3yEKt2yaYR3XJQPE=
 github.com/ipfs/go-path v0.0.7/go.mod h1:6KTKmeRnBXgqrTvzFrPV3CamxcgvXX/4z79tfAd2Sno=
 github.com/ipfs/go-path v0.0.9 h1:BIi831cNED8YnIlIKo9y1SI3u+E+FwQQD+rIIw8PwFA=
 github.com/ipfs/go-path v0.0.9/go.mod h1:VpDkSBKQ9EFQOUgi54Tq/O/tGi8n1RfYNks13M3DEs8=
@@ -580,7 +578,11 @@ github.com/libp2p/go-conn-security-multistream v0.0.2/go.mod h1:nc9vud7inQ+d6SO0
 github.com/libp2p/go-conn-security-multistream v0.1.0/go.mod h1:aw6eD7LOsHEX7+2hJkDxw1MteijaVcI+/eP2/x3J1xc=
 github.com/libp2p/go-conn-security-multistream v0.2.0/go.mod h1:hZN4MjlNetKD3Rq5Jb/P5ohUnFLNzEAR4DLSzpn2QLU=
 github.com/libp2p/go-conn-security-multistream v0.2.1 h1:ft6/POSK7F+vl/2qzegnHDaXFU0iWB4yVTYrioC6Zy0=
+github.com/libp2p/go-conn-security-multistream v0.2.1 h1:ft6/POSK7F+vl/2qzegnHDaXFU0iWB4yVTYrioC6Zy0=
+github.com/libp2p/go-conn-security-multistream v0.2.1/go.mod h1:cR1d8gA0Hr59Fj6NhaTpFhJZrjSYuNmhpT2r25zYR70=
 github.com/libp2p/go-conn-security-multistream v0.2.1/go.mod h1:cR1d8gA0Hr59Fj6NhaTpFhJZrjSYuNmhpT2r25zYR70=
+github.com/libp2p/go-doh-resolver v0.3.0 h1:YePXUmvjyFT7NsqgnEkhEi5d/Nqab97QZf7BPNUWSqo=
+github.com/libp2p/go-doh-resolver v0.3.0/go.mod h1:y5go1ZppAq9N2eppbX0xON01CyPBeUg2yS6BTssssog=
 github.com/libp2p/go-eventbus v0.1.0/go.mod h1:vROgu5cs5T7cv7POWlWxBaVLxfSegC5UGQf8A2eEmx4=
 github.com/libp2p/go-eventbus v0.2.1 h1:VanAdErQnpTioN2TowqNcOijf6YwhuODe4pPKSDpxGc=
 github.com/libp2p/go-eventbus v0.2.1/go.mod h1:jc2S4SoEVPP48H9Wpzm5aiGwUCBMfGhVhhBjyhhCJs8=
@@ -896,6 +898,8 @@ github.com/miekg/dns v1.1.12/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3N
 github.com/miekg/dns v1.1.28/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7xM=
 github.com/miekg/dns v1.1.31/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7xM=
 github.com/miekg/dns v1.1.41 h1:WMszZWJG0XmzbK9FEmzH2TVcqYzFesusSIB41b8KHxY=
+github.com/miekg/dns v1.1.41 h1:WMszZWJG0XmzbK9FEmzH2TVcqYzFesusSIB41b8KHxY=
+github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
 github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
 github.com/minio/blake2b-simd v0.0.0-20160723061019-3f5f724cb5b1 h1:lYpkrQH5ajf0OXOcUbGjvZxxijuBwbbmlSxLiuofa+g=
 github.com/minio/blake2b-simd v0.0.0-20160723061019-3f5f724cb5b1/go.mod h1:pD8RvIylQ358TN4wwqatJ8rNavkEINozVn9DtGI3dfQ=
@@ -942,7 +946,10 @@ github.com/multiformats/go-multiaddr v0.3.1/go.mod h1:uPbspcUPd5AfaP6ql3ujFY+QWz
 github.com/multiformats/go-multiaddr-dns v0.0.1/go.mod h1:9kWcqw/Pj6FwxAwW38n/9403szc57zJPs45fmnznu3Q=
 github.com/multiformats/go-multiaddr-dns v0.0.2/go.mod h1:9kWcqw/Pj6FwxAwW38n/9403szc57zJPs45fmnznu3Q=
 github.com/multiformats/go-multiaddr-dns v0.2.0/go.mod h1:TJ5pr5bBO7Y1B18djPuRsVkduhQH2YqYSbxWJzYGdK0=
+github.com/multiformats/go-multiaddr-dns v0.3.0/go.mod h1:mNzQ4eTGDg0ll1N9jKPOUogZPoJ30W8a7zk66FQPpdQ=
 github.com/multiformats/go-multiaddr-dns v0.3.1 h1:QgQgR+LQVt3NPTjbrLLpsaT2ufAA2y0Mkk+QRVJbW3A=
+github.com/multiformats/go-multiaddr-dns v0.3.1 h1:QgQgR+LQVt3NPTjbrLLpsaT2ufAA2y0Mkk+QRVJbW3A=
+github.com/multiformats/go-multiaddr-dns v0.3.1/go.mod h1:G/245BRQ6FJGmryJCrOuTdB37AMA5AMOVuO6NY3JwTk=
 github.com/multiformats/go-multiaddr-dns v0.3.1/go.mod h1:G/245BRQ6FJGmryJCrOuTdB37AMA5AMOVuO6NY3JwTk=
 github.com/multiformats/go-multiaddr-fmt v0.0.1/go.mod h1:aBYjqL4T/7j4Qx+R73XSv/8JsgnRFlf0w2KGLCmXl3Q=
 github.com/multiformats/go-multiaddr-fmt v0.1.0 h1:WLEFClPycPkp4fnIzoFoV9FVd49/eQsuaL3/CWe167E=
@@ -973,6 +980,7 @@ github.com/multiformats/go-multistream v0.1.0/go.mod h1:fJTiDfXJVmItycydCnNx4+wS
 github.com/multiformats/go-multistream v0.1.1/go.mod h1:KmHZ40hzVxiaiwlj3MEbYgK9JFk2/9UktWZAF54Du38=
 github.com/multiformats/go-multistream v0.2.0/go.mod h1:5GZPQZbkWOLOn3J2y4Y99vVW7vOfsAflxARk3x14o6k=
 github.com/multiformats/go-multistream v0.2.1/go.mod h1:5GZPQZbkWOLOn3J2y4Y99vVW7vOfsAflxARk3x14o6k=
+github.com/multiformats/go-multistream v0.2.1/go.mod h1:5GZPQZbkWOLOn3J2y4Y99vVW7vOfsAflxARk3x14o6k=
 github.com/multiformats/go-multistream v0.2.2 h1:TCYu1BHTDr1F/Qm75qwYISQdzGcRdC21nFgQW7l7GBo=
 github.com/multiformats/go-multistream v0.2.2/go.mod h1:UIcnm7Zuo8HKG+HkWgfQsGL+/MIEhyTqbODbIUwSXKs=
 github.com/multiformats/go-varint v0.0.1/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
diff --git a/test/sharness/t0020-init.sh b/test/sharness/t0020-init.sh
index 2cabe3d8f75..55ae34eadb9 100755
--- a/test/sharness/t0020-init.sh
+++ b/test/sharness/t0020-init.sh
@@ -202,7 +202,7 @@ test_expect_success "'ipfs init --profile' succeeds" '
 
 test_expect_success "'ipfs config Swarm.AddrFilters' looks good" '
   ipfs config Swarm.AddrFilters > actual_config &&
-  test $(cat actual_config | wc -l) = 22
+  test $(cat actual_config | wc -l) = 18
 '
 
 test_expect_success "clean up ipfs dir" '
diff --git a/test/sharness/t0021-config.sh b/test/sharness/t0021-config.sh
index c417ba4de57..ee0e81988dd 100755
--- a/test/sharness/t0021-config.sh
+++ b/test/sharness/t0021-config.sh
@@ -209,7 +209,7 @@ test_config_cmd() {
 
   test_expect_success "'ipfs config Swarm.AddrFilters' looks good with server profile" '
     ipfs config Swarm.AddrFilters > actual_config &&
-    test $(cat actual_config | wc -l) = 22
+    test $(cat actual_config | wc -l) = 18
   '
 
   test_expect_success "'ipfs config profile apply local-discovery' works" '