Guides · DNS · Updated

DNS over HTTPS vs DNS over TLS

Ordinary DNS queries travel in plain text, so anyone on the path can read which names you look up. DNS over HTTPS (DoH) and DNS over TLS (DoT) wrap those queries in encryption. They protect the same thing and differ mainly in how they are carried and how easily a network can spot them.

What both of them fix

A classic DNS lookup leaves your device as an unencrypted UDP packet on port 53. Your Wi-Fi operator, your ISP and anyone between you and the resolver can see the name, and a hostile network can change the answer. Encrypted DNS closes that gap on the hop between your device and the recursive resolver that answers for you. See what is DNS for how that resolver fits in.

The two protocols

DNS over TLS (DoT)DNS over HTTPS (DoH)
StandardRFC 7858RFC 8484
Port853443
Carried inA TLS connection of its ownHTTPS requests
Visible as DNS to the networkYes, the port gives it awayNo, it looks like web traffic
Easy to blockYes, block port 853Hard without blocking the resolver address
Where it's set upOperating system (Android Private DNS, Linux, routers)Browsers and operating systems

A third option, DNS over QUIC (RFC 9250), also uses port 853 and is less widely deployed.

Which one to choose

  • Network administrators usually prefer DoT, because it sits on its own port and can be allowed, logged or blocked on purpose.
  • Individual users often get DoH, because browsers support it and it keeps working on networks that block unusual ports.
  • Speed is about the same. A resolver close to you matters much more than the protocol.

On Android, Private DNS is DoT: enter the resolver hostname. In Firefox and Chrome, DoH is a setting under privacy and security. Windows 11 supports DoH for resolvers it knows. The big public resolvers, including Cloudflare (1.1.1.1), Google (8.8.8.8) and Quad9 (9.9.9.9), offer both. The public DNS servers page lists them and tests their response time from your connection.

Compare resolvers before you switch:

Open the public DNS test

What encryption does not do

  • It doesn't hide where you go. The IP address you connect to is still visible, and the site name is often sent in the clear in the TLS handshake.
  • It moves trust, it doesn't remove it. The resolver you pick sees every name you look up. Choose one whose privacy policy you accept.
  • It doesn't cover the rest of the path. The resolver still talks to authoritative servers, usually unencrypted.
  • It doesn't prove answers are genuine. That's the job of DNSSEC. See DNS attacks explained.

Turning it on

  1. Pick a resolver that supports the protocol you want, and note its hostname or DoH address.
  2. Enter it in the browser or operating system setting.
  3. Open a site and confirm it loads. If a work or school network stops resolving internal names, switch back, because internal names live on the organisation's own resolver.

Frequently asked questions

What is the main difference between DoH and DoT?

Both encrypt the query between your device and the resolver. DoT uses its own port, 853, so it is easy for a network to spot and block. DoH travels on port 443 inside ordinary HTTPS traffic, so it is harder to tell apart from web browsing.

Does DNS over HTTPS hide my browsing from my ISP?

It hides the DNS queries, not everything. The addresses you connect to are still visible, and the site name is often visible in the TLS handshake. It also moves trust to the resolver you choose, which then sees every query.

Is DoH or DoT faster?

Not noticeably in everyday use. Both need a handshake when the connection opens and then reuse it. A nearby resolver with a warm cache matters far more than the protocol.

Does encrypted DNS replace DNSSEC?

No. Encryption protects the path between you and the resolver. DNSSEC proves the answer itself is genuine. They solve different problems and can be used together.