EMZETT.DNS over HTTPS and DNS over TLS: Encrypted name resolution
In short: Methods that encrypt DNS queries so that third parties on the network cannot read which websites a device visits.
In more detail: Classic DNS transmits queries in plain text over UDP port 53. Everyone on the way (Wi-Fi operator, provider) sees which names are resolved and can alter responses. DoT (DNS over TLS, port 853) and DoH (DNS over HTTPS, port 443) wrap the queries in an encrypted connection.
In Depth
Differences
- DoT uses a port of its own. Network operators can easily recognise it and block it or allow it specifically.
- DoH runs over normal HTTPS traffic (port 443) and is hard to tell apart from other web traffic. Browsers such as Firefox and Chrome can support it directly, even without a setting in the operating system. Both protect the path between you and the resolver. The resolver itself still sees all queries.
What it brings and what not
You gain protection against eavesdropping and manipulation on public Wi-Fi or at the provider. Not hidden is the destination IP address, which stays visible during the connection, and often the server name (SNI) in the TLS handshake (Encrypted Client Hello is meant to close that). With DoH you trust the chosen provider (for example Cloudflare, Google, Quad9 or your own resolver) instead of the ISP.
Setting it up
On Windows 11 and Android (“Private DNS”) DoT/DoH can be entered in the network settings. In Firefox: Settings → Privacy → DNS over HTTPS. On a router or your own server, a resolver such as Unbound, dnsdist or AdGuard Home takes over the encryption for all devices on the network.
Disadvantages
In company networks DoH can bypass internal names and filters, which is why administrators control it or define internal resolution by policy. Troubleshooting gets harder because classic captures no longer show the queries. DNSSEC additionally checks the authenticity of the answers, whereas DoH/DoT protect the confidentiality of the transport.