How DoH and DoT differ
DNS over TLS (DoT) and DNS over HTTPS (DoH) both encrypt DNS queries between your device and a recursive resolver. DoT runs DNS inside a TLS connection on its own port, 853. DoH sends DNS messages as HTTPS requests on port 443, the same port as ordinary web traffic.
Both stop people on your local network or along your ISP's path from reading or changing your lookups. Neither hides your queries from the resolver you send them to.
DoT is defined in RFC 7858 and DoH in RFC 8484. A newer option, DNS over QUIC (RFC 9250), uses UDP port 853.
What classic DNS exposes
Traditional DNS sends queries and answers unencrypted over port 53. Anyone who can see the traffic, such as the Wi-Fi operator, your ISP or a compromised router, can log every name you look up.
They can also change answers in transit and send you to a different address. For an HTTPS site, a forged answer usually ends in a certificate error, but plain HTTP and many other protocols have no such check.
What encrypted DNS hides, and what it still reveals
Encrypted DNS hides the names you look up, and the answers, from anyone between your device and the resolver. It also stops them from altering those answers in transit. Several things stay visible:
- The resolver sees every query along with your IP address. Encryption moves your trust from the network to the resolver operator, so its logging policy matters.
- The IP address of the site you connect to next is visible to the network, and it often identifies the site or at least its hosting provider.
- The TLS handshake for that site carries the hostname in plain text in the SNI field, unless both the browser and the server support Encrypted Client Hello (ECH).
- Encryption covers only the hop to your resolver. The resolver's own queries to root, TLD and authoritative servers are usually still unencrypted.
- Encrypted transport does not prove that the records are genuine. Checking that they came from the zone's owner is the job of DNSSEC.
Choosing between DoT and DoH
DoT's dedicated port makes it easy to identify, allow or block at a firewall. It is common as a system-wide setting; Android's Private DNS option, for example, uses DoT.
DoH looks like other HTTPS traffic on port 443, so it is harder to single out and tends to work on networks that block port 853. Firefox, Chrome and Edge support DoH, and Windows 11 and Apple platforms can be set to use encrypted DNS system-wide.
For privacy, the protocol matters less than two other choices: which resolver you trust, and whether your device falls back to unencrypted DNS when the encrypted connection fails.
The trade-off with network filtering
Many schools, companies and parental-control setups filter or log DNS at their own resolver. When a browser sends DoH to an outside resolver, that filtering stops applying, and internal names that only the local resolver knows may stop resolving.
Browsers include ways to avoid this. Firefox turns off its default DoH when the network's resolver blocks the canary domain use-application-dns.net. Chrome's automatic mode upgrades to DoH only when your current resolver's provider supports it. Managed browser policies can turn DoH off or point it at an approved resolver.
For a network administrator, blocking DoT means closing port 853. Blocking DoH is harder and usually relies on browser policies or on blocking known DoH resolver addresses, and neither stops a determined user on an unmanaged device.