DNS over HTTPS (DoH) and DNS over TLS (DoT): Encrypted Lookups Explained

DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt the DNS queries between you and your resolver, so no one on the network can see or tamper with which sites you look up. They close a long-standing privacy gap: traditional DNS travels in plain text for anyone in between to read.

The problem: plain-text DNS

Ordinary DNS queries are unencrypted. Your ISP, a public Wi-Fi operator, or anyone on the path can observe every domain you resolve, and could even tamper with the answers. DoH and DoT wrap those queries in encryption so they are private and integrity-protected in transit.

DoT: DNS over TLS

DoT sends DNS queries over a TLS-encrypted connection on a dedicated port (853). Because it uses its own port, network operators can see that DoT is in use (and could block the port), but not the query contents. It is clean and purpose-built for DNS.

DoH: DNS over HTTPS

DoH sends DNS queries inside normal HTTPS traffic on port 443 — the same port as regular web browsing. This makes DoH traffic blend in with all other HTTPS, so it is much harder to single out or block. Browsers have led DoH adoption.

DoH vs DoT

• DoT — separate port (853), easy for networks to identify as DNS; favoured by OS-level resolvers.
• DoH — shares port 443 with web traffic, harder to block; favoured by browsers.

Encryption is not authentication

This is the key distinction: DoH/DoT provide privacy (encrypting the query), while DNSSEC provides authenticity (proving the answer is genuine). They solve different problems and are complementary — encrypted transport to your resolver, plus signed records to prove those answers are real. For the standard resolution path these sit on top of, see how DNS resolution works.

Frequently asked questions

Does DoH/DoT replace DNSSEC?

No — they encrypt the query for privacy, while DNSSEC signs answers to prove they are authentic. One hides what you look up; the other proves the answer was not forged. Ideally you benefit from both.

What's the practical difference between DoH and DoT?

DoT uses a dedicated port, so networks can see (and potentially block) that DNS is happening; DoH rides on standard HTTPS port 443, blending with web traffic and being harder to block. Browsers tend to use DoH; operating systems often use DoT.

Does encrypted DNS hide my browsing completely?

It hides your DNS queries from the network, but not everything — the destination IP and other signals can still reveal activity. It is a meaningful privacy improvement for DNS specifically, not total anonymity.