DNS Privacy Leaks
Even when browsing HTTPS sites, classic DNS queries travel in plaintext. Local network operators, ISPs, and eavesdroppers can log every domain lookup you perform, mapping out your browsing history.
DNS over TLS (DoT)
DoT encrypts DNS queries via TLS, sending them over a dedicated port (853). This separates DNS traffic from other web communications, making it easy for firewalls to monitor or filter but completely secure from local eavesdropping.
DNS over HTTPS (DoH)
DoH sends DNS queries wrapped in HTTP/2 or HTTP/3 payloads over the standard HTTPS port (443). DoH lookups blend in with regular web traffic, preventing network operators from blocking or filtering DNS resolution without blocking the entire site.