DoH vs DoT vs DoQ: Encrypted DNS Protocols Compared

Why encrypt DNS at all?

Classic DNS sends every query and answer as plain text, usually over UDP port 53. Anyone on the path between your device and the resolver, such as a public Wi-Fi operator, an internet provider or an attacker on the local network, can read which domains you look up. They can also forge answers, sending you to a server of their choosing. Encrypted DNS protocols wrap DNS messages in an encrypted, authenticated channel to stop both problems.

Three protocols dominate today: DNS-over-TLS (DoT), DNS-over-HTTPS (DoH) and DNS-over-QUIC (DoQ). They protect the same thing, the path between client and resolver, but differ in transport, port, performance characteristics and how easy they are for networks to manage.

DNS-over-TLS (DoT)

DoT, standardised in RFC 7858, sends ordinary DNS messages over a TLS connection on TCP port 853. Because it uses a dedicated port, DoT traffic is easy to recognise. That is helpful for network administrators who want to allow DoT to their chosen resolver and block it to everyone else, and it is a drawback for users on restrictive networks where port 853 may be blocked.

DoT is widely supported in network equipment and operating systems. Android's Private DNS feature uses DoT, and many routers, firewalls and resolvers such as Unbound and systemd-resolved can forward queries over DoT.

• Transport: TLS over TCP
• Port: 853
• Strength: easy to identify and manage on networks
• Common uses: Android Private DNS, routers, resolvers forwarding upstream

DNS-over-HTTPS (DoH)

DoH, standardised in RFC 8484, sends DNS queries as HTTPS requests, normally on port 443. To the network, DoH looks like any other encrypted web traffic. That makes it hard to block selectively, which protects users on censoring or hostile networks, and it lets browsers and apps implement encrypted DNS themselves without relying on the operating system.

DoH has broad client support: Chrome, Edge, Firefox, Brave, Windows 11, macOS and iOS can all use it. The flexibility has a cost for organisations: when a browser uses its own DoH resolver, it bypasses the network's DNS policy. Administrators therefore manage browser DoH settings through policy, and point them at the organisation's filtering resolver where possible.

• Transport: HTTPS (HTTP/2 or HTTP/3)
• Port: 443
• Strength: blends with web traffic, easy for apps to implement
• Common uses: browsers, Windows, Apple platforms

DNS-over-QUIC (DoQ)

DoQ, standardised in RFC 9250, carries DNS over QUIC, the UDP-based transport that also underpins HTTP/3. QUIC combines encryption and transport setup into fewer round trips and avoids head-of-line blocking, where one delayed packet holds up others. The goal is encrypted DNS with latency closer to classic UDP DNS. DoQ uses UDP port 853 by default.

Support for DoQ is growing but still limited compared with DoT and DoH. Several resolvers and some client software support it, while mainstream operating systems mostly do not yet offer it as a built-in option. [VERIFY: current OS-level DoQ support before publishing] Note that DoH over HTTP/3 also runs on QUIC, so some of DoQ's performance benefits are available through DoH too.

• Transport: QUIC over UDP
• Port: 853 (UDP)
• Strength: low latency, no head-of-line blocking
• Common uses: resolvers and specialist clients; limited OS support

Side-by-side comparison

All three protocols encrypt and authenticate the connection between client and resolver, so in terms of privacy on the network path they are broadly equivalent. Their practical differences come down to manageability and support.

• Visibility to network administrators: DoT and DoQ use port 853 and are easy to identify; DoH blends in on port 443
• Client support: DoH is the most widely supported in browsers and desktop systems; DoT is native on Android; DoQ is emerging
• Performance: all are fast once a connection is established; DoQ and DoH over HTTP/3 reduce connection setup time
• Blocking resistance: DoH is hardest to block; DoT and DoQ are easier to block on restrictive networks

What encryption does not protect

Encrypted DNS protects the query between your device and the resolver. It does not hide your lookups from the resolver itself, so the resolver's privacy policy and logging practices still matter. It does not hide the IP addresses you connect to afterwards, and the site name may still be visible in the TLS handshake of the actual connection unless Encrypted Client Hello is used. It is a privacy improvement on the network path, not anonymity.

Encrypted DNS and DNS filtering

Encrypted DNS and DNS filtering are complementary when the encrypted connection goes to your filtering resolver. In that case, you get both: lookups are hidden from the network path and filtered according to your policy. Problems arise only when a device or app sends encrypted DNS to a different resolver, which bypasses your filtering without the network noticing.

For organisations, the practical approach is to provide encrypted DNS to your own filtering resolver, block DoT and DoQ (port 853) to other destinations at the firewall, and manage browser DoH settings by policy. Blocking all DoH is harder because it uses port 443; blocking known public DoH endpoints by domain or IP and disabling browser DoH by policy covers most cases.

Which protocol should you use?

For Android phones, use Private DNS (DoT) with your filtering resolver's hostname. For browsers and desktop systems, DoH is usually the easiest option. For routers and firewalls forwarding queries upstream, DoT is widely supported and easy to manage. Consider DoQ where both your resolver and client support it and latency matters, but do not expect it to be available everywhere yet.

Inside a trusted network where you control the path to the resolver, classic DNS on port 53 remains acceptable, especially when the resolver is your own filtering service and outbound DNS to other servers is blocked.

Encrypted DNS with FirewallDNS

FirewallDNS is designed to accept encrypted DNS alongside classic port 53 queries. [VERIFY: DoH, DoT and DoQ availability and the dashboard location of encrypted DNS addresses before publishing] Our device guides for Windows 11, macOS, iPhone, Android, Chrome, Firefox, Edge and Brave show where to enter encrypted DNS settings on each platform.

A note on DNSSEC

Encrypted DNS is sometimes confused with DNSSEC, but they solve different problems. DNSSEC lets a resolver verify that DNS answers really come from the domain owner and have not been altered, using digital signatures. It does not encrypt anything. DoT, DoH and DoQ encrypt the connection between your device and the resolver but do not, by themselves, prove that the resolver's answers are authentic. A validating resolver reached over an encrypted protocol gives you both: privacy on the network path and assurance about the answers. [VERIFY: whether FirewallDNS performs DNSSEC validation]

Summary

DoT, DoH and DoQ all encrypt DNS between your device and the resolver. DoT is easy to manage, DoH is widely supported and hard to block, and DoQ promises lower latency with growing support. Whichever you choose, make sure the encrypted connection goes to a resolver you trust, ideally one that also filters malicious domains, and prevent devices from quietly using a different one.