DNS over TLS
DoT — Encrypted DNS
DNS lookups normally travel in the clear, so anyone in the path can see — and even change — which sites you visit. DNS over TLS wraps them in encryption on a dedicated port, closing that privacy hole.
DNS over TLS (DoT) encrypts your DNS queries by carrying them inside a TLS connection on a dedicated port — 853. Traditional DNS is plain text: every lookup announces which domain you are about to visit to anyone watching the network, including your ISP, and a malicious party can even forge responses to redirect you. DoT closes that gap by making the queries unreadable and tamper-proof in transit.
What it protects
| Without DoT | With DoT |
|---|---|
| ISP and network can log every domain you look up | Lookups are encrypted and unreadable in transit |
| On-path attackers can spoof DNS replies | Responses are authenticated against tampering |
| Public Wi-Fi can hijack or filter DNS | Queries go securely to your chosen resolver |
Note what it does not hide: the actual IP address you then connect to is still visible, and the SNI in older TLS can reveal the site name. DoT secures the lookup, one important piece of the privacy picture.
DoT vs DoH
DoT and DoH (DNS over HTTPS) achieve the same goal — encrypted DNS — but differ in how they blend in:
| DoT | DoH | |
|---|---|---|
| Port | 853 (dedicated) | 443 (shared with HTTPS) |
| Visibility | Identifiable as DNS | Indistinguishable from web traffic |
| Network control | Easy to manage/monitor as DNS | Hard to block or single out |
Because DoT uses its own port, network administrators can recognise and manage it as DNS — useful for filtering and visibility. DoH hides among normal web traffic, which maximises user privacy on hostile or censoring networks but frustrates legitimate network management. Neither is strictly "better"; they reflect different priorities.
Performance
The cost of DoT is small. Establishing the TLS session to the resolver adds a one-time handshake, but that connection is kept open and reused across many lookups, so the per-query overhead is negligible. With a fast, nearby resolver the privacy benefit comes essentially for free — and it complements, rather than replaces, DNSSEC, which authenticates the data while DoT encrypts the channel.
Where it is used
DoT is widely supported: Android offers it system-wide as "Private DNS," many routers and resolvers (including major public ones) support it, and it is common in privacy-focused setups. If you want encrypted DNS that the network can still recognise and manage as DNS, DoT is the natural choice; if you want it to be invisible, DoH is the counterpart. Either way, moving off plain-text DNS is a meaningful upgrade to everyday privacy.