Both DNS over HTTPS (DoH) and DNS over TLS (DoT) are protocols designed to encrypt traditional, plain-text DNS queries. Historically, your DNS requests (like looking up google.com) were sent in the clear, meaning anyone on your local network, your ISP, or a malicious actor could spy on or tamper with them.
While both achieve the goal of privacy and security through encryption, they go about it in slightly different ways.
🛠️ The Core Difference: Ports and Traffic
The easiest way to understand the difference is to look at how they package and send data.
| Feature | DNS over TLS (DoT) | DNS over HTTPS (DoH) |
|---|---|---|
| Protocol/Port | Dedicated Port (853) | Standard HTTPS Port (443) |
| Traffic Appearance | Looks distinctly like encrypted DNS. | Looks exactly like normal web traffic. |
| Visibility | Network admins can easily block it. | Hard to block without blocking all HTTPS web traffic. |
| Primary Focus | Network-level security. | Application-level privacy (e.g., in browsers). |
🔒 DNS over TLS (DoT)
DoT wraps the original DNS protocol directly in a Transport Layer Security (TLS) tunnel. It operates on its own dedicated port: Port 853.
How it works:
Because it has its own port, DoT traffic is highly visible on a network. A network administrator can see exactly where the encrypted DNS requests are going and can easily block Port 853 if they want to force devices back onto standard, unencrypted DNS.
- Pros: It’s efficient, has slightly less overhead than DoH, and gives network administrators better control over their network security.
- Cons: It is easy to block or censor by firewalls or restrictive ISPs.
🌐 DNS over HTTPS (DoH)
DoH hides DNS queries inside standard HTTP/2 or HTTP/3 web traffic. It uses Port 443, which is the exact same port used for all secure web browsing (HTTPS).
How it works:
To an ISP or firewall, a DoH query looks completely identical to standard encrypted web traffic (like regular browsing or streaming).
- Pros: Incredible for bypassing censorship and firewalls. If a network tries to block DoH by shutting down Port 443, they effectively shut down the entire internet for their users.
- Cons: It can bypass local network security controls (which parents or corporate IT departments might use to block malicious sites). It also introduces a tiny bit more data overhead due to the HTTP packaging.
⚔️ Which One is Better?
Neither is universally “better”; it depends entirely on your use case:
- Choose DoT if: You want to secure an entire device or home network (like setting it up on your router or via a local Pi-hole). It separates DNS traffic cleanly from web traffic, making troubleshooting and network management easier.
- Choose DoH if: You are trying to bypass internet censorship, prevent your ISP from tracking your browsing habits, or want to secure just a specific web browser (like enabling it in Firefox or Chrome settings).
Are you looking to implement one of these on your local network, or just trying to decide which setting to toggle on your web browser?
