DNS over HTTPS vs DNS over TLS

DNS over HTTPS (DoH) and DNS over TLS (DoT) both encrypt DNS queries so they can’t be read or tampered with in transit, but they do it differently: DoH wraps DNS inside an HTTPS request on the standard web port 443, while DoT wraps it in a dedicated TLS connection on port 853. The encryption underneath is the same; the transport and how easy the traffic is to identify are not.

Why encrypt DNS at all

Plain DNS queries are sent unencrypted over UDP port 53. Anyone positioned between a client and its resolver — an ISP, a public Wi-Fi operator, an attacker on the same network — can see every domain name a device looks up, and can potentially forge responses to redirect traffic (the premise behind DNS cache poisoning). Both DoH and DoT close that gap by running the query inside an encrypted TLS tunnel, so an observer sees only that a connection was made to a resolver, not which names were resolved.

DNS over TLS (DoT)

DoT wraps DNS queries directly in a TLS session, running on its own dedicated port, 853. Because it’s a distinct, recognizable port, DoT traffic is easy to tell apart from ordinary web traffic — which is a tradeoff: a network administrator (or a censor) can simply block port 853 to disable DoT wholesale, since nothing else runs there. DoT is a natural fit for infrastructure that wants encrypted DNS as an explicit, separately configured service, and it’s the standard many operating systems and routers implement for system-wide encrypted DNS.

DNS over HTTPS (DoH)

DoH sends the DNS query as an HTTPS request, indistinguishable at the network level from any other HTTPS traffic on port 443. This is DoH’s defining property: because it looks identical to ordinary web browsing, it’s much harder to selectively block without also blocking general HTTPS access. That’s a privacy win in restrictive network environments, but it’s also the source of most of the controversy around DoH — network operators lose the easy ability to see and filter DNS traffic separately from everything else, which affects enterprise monitoring, parental controls, and malware domain blocklists that used to key off plain DNS.

DoH vs DoT compared

	DoH	DoT
Port	443 (shared with HTTPS)	853 (dedicated)
Transport	HTTP/2 or HTTP/3 over TLS	TLS directly
Distinguishable from other traffic	No — blends with regular HTTPS	Yes — its own port
Easy to block at the network level	Hard, without blocking HTTPS generally	Easy — block the port
Typical implementer	Browsers (per-application)	OS / router (system-wide)
Enterprise visibility impact	High — DNS monitoring tools may miss it	Lower — still separable by port

Where each is typically configured

DoH is most often configured inside individual applications — a browser’s network settings, for instance — which means different apps on the same device can point at different resolvers, and a network-level DNS policy set at the router doesn’t necessarily apply. DoT is more commonly configured at the operating system or network level, applying uniformly to all traffic leaving a device, which fits better with centralized network administration and matches how a VPN client typically routes all DNS traffic through one tunnel rather than app by app.

Neither protocol is a substitute for DNSSEC, which serves a different purpose: DoH and DoT protect the confidentiality and integrity of a query in transit between client and resolver, while DNSSEC lets the resolver verify that the DNS records themselves haven’t been tampered with further up the chain, back to the authoritative source. A fully hardened setup typically uses both — an encrypted transport for the last hop to the resolver, and DNSSEC validation for the records the resolver ultimately returns.

Which one is “more secure”

Neither has a cryptographic edge over the other — both rely on standard TLS. The practical difference is about visibility and control, not security strength. If the goal is resisting network-level DNS blocking or surveillance, DoH’s indistinguishability from regular web traffic makes it more effective. If the goal is centralized, auditable encrypted DNS across an entire network or organization — where administrators still want a clean way to identify and manage DNS traffic — DoT’s dedicated port is the better fit.

The takeaway

DoH and DoT both encrypt DNS lookups with TLS; the meaningful difference is that DoH rides inside ordinary HTTPS traffic on port 443 and is hard to block or distinguish, while DoT uses its own dedicated port 853 and is easy to identify and manage separately. Neither replaces DNSSEC’s job of verifying record authenticity — pick based on whether you need traffic to blend in or need it to stay cleanly separable for network administration.