DNS over HTTPS and DNS over TLS Explained
By [FILL IN], [FILL IN] · Last updated
Classic DNS is sent in plain text. Learn how DoH and DoT encrypt lookups, protect privacy and how they work together with filtering.
The problem with plain DNS
Traditional DNS travels unencrypted over port 53. Anyone on the path, such as a public Wi-Fi operator or your ISP, can read and even alter the answers.
DoT and DoH
DNS over TLS (DoT) wraps lookups in TLS on port 853. DNS over HTTPS (DoH) sends them inside normal HTTPS on port 443. Both encrypt the question and the answer between your device and the resolver.
- DoT: easy to identify and manage on a network, supported natively by Android Private DNS
- DoH: blends in with web traffic, supported by all major browsers, Windows 11, iOS and macOS
Encryption plus filtering
Encryption alone hides your lookups from the network but does not block anything. Pointing encrypted DNS at a filtering resolver gives you both privacy and protection.
Watch out for bypass
Apps that ship their own DoH resolver can skip your network filter. Blocking known public DoH endpoints keeps rules in force on every device.