DNS over HTTPS (DoH) vs DNS over TLS (DoT)
Traditional DNS uses UDP port 53 with no encryption – anyone on the network path can read, modify, or block DNS queries. DoH (RFC 8484) and DoT (RFC 7858) both encrypt DNS queries using TLS, preventing ISP surveillance and man-in-the-middle attacks. The difference is how they blend into network traffic and how network operators can manage them. Both move trust from the local network to the chosen resolver (Cloudflare, Google, NextDNS).
Both DoH and DoT encrypt DNS queries to prevent eavesdropping and tampering. DoH runs DNS over HTTPS on port 443 – indistinguishable from web traffic, harder to block, browser-friendly. DoT runs DNS over TLS on a dedicated port 853 – identifiable as DNS traffic, easier for network admins to monitor and filter. Neither prevents the resolver from seeing your queries.
| Feature | DNS over HTTPS (DoH) | DNS over TLS (DoT) |
|---|---|---|
| Port | 443 (HTTPS) – same as all web traffic | 853 (dedicated DNS-over-TLS port) |
| Protocol | DNS queries inside HTTP/2 or HTTP/3 over TLS | DNS queries directly over TLS (RFC 7858) |
| Identifiability | Cannot distinguish from HTTPS – appears as web traffic | Identifiable as DNS by port 853 – can be monitored or blocked |
| Network admin control | Hard to block without breaking all HTTPS | Easy to block or monitor – dedicated port |
| Browser integration | Supported natively in Firefox, Chrome, Edge | OS-level resolver only – not browser-native |
| API format | HTTP GET (base64url) or HTTP POST (binary) | Binary DNS wire format over TLS stream |
| Multiplexing | HTTP/2 multiplexing – many queries per connection | Pipelining – multiple queries per TLS session |
| Latency | HTTP overhead – slightly higher first connection | Lower overhead – DNS wire format is minimal |
| RFC | RFC 8484 | RFC 7858 |
| OS support | Android 9+ (Private DNS), Windows 11, iOS | Android 9+ (Private DNS), iOS, Windows 11, Linux (systemd-resolved) |
When to use DNS over HTTPS (DoH)
DoH is the right choice for browser-level privacy in environments where port 853 might be blocked, for application-level DNS control without OS changes, and for developers building DNS-aware applications (easy HTTP client integration). Most consumer users interact with DoH through browser settings (Firefox Trusted Recursive Resolver, Chrome Secure DNS).
When to use DNS over TLS (DoT)
DoT is better for network administrators who want encrypted DNS but need visibility and control over DNS traffic. It is easier to monitor (traffic on port 853 is identifiably DNS), and easier to enforce at the organization boundary. Enterprise networks often deploy DoT to internal resolvers while allowing inspection of query patterns.
Common Mistakes
- Assuming DoH/DoT makes you anonymous – they prevent your ISP and local network from seeing your queries, but your chosen resolver (Cloudflare, Google, NextDNS) sees all queries. You are shifting trust from your ISP to the resolver.
- Enabling DoH in browsers without considering enterprise DNS policies – browsers with DoH bypass corporate DNS resolvers, breaking internal DNS resolution (intranet.company.com), split-horizon DNS, and content filtering.
- Confusing DoH/DoT with DNSSEC – DNSSEC prevents DNS response tampering by signing records, but doesn't encrypt queries. DoH/DoT encrypts the transport but doesn't verify record authenticity. They address different threat models.
- Not setting a fallback resolver – if the DoH/DoT endpoint is unreachable and no fallback is configured, DNS fails completely. Always configure a fallback to plain DNS (or a secondary DoH endpoint).
FAQ
Which is more private – DoH or DoT?
They provide equivalent privacy in terms of encryption strength – both use TLS. The difference is traffic analysis: DoT on port 853 is identifiable as DNS by any observer, even if encrypted. DoH on port 443 is indistinguishable from HTTPS traffic. If your threat model includes an adversary who can observe but not decrypt traffic, DoH leaks less metadata.
What is DNS over QUIC (DoQ)?
DNS over QUIC (RFC 9250) is a third option that runs DNS over QUIC on UDP port 853. It provides the same privacy as DoT with QUIC's performance benefits (0-RTT resumption, no TCP head-of-line blocking). DoQ is supported by AdGuard DNS and NextDNS but not yet mainstream in browsers or operating systems.