Skip to main content

How can we help you?

Search

help Knowledge Base
forum Community
checklist Release Notes
event Events

DNS over TLS vs DNS over HTTPS

Minetta Gould
  • Updated

    In this article

This article explains the differences between DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH), including how DNSFilter security settings interact with these protocols.

Why DNS Encryption matters

Traditional DNS traffic is sent in plain text, which allows attackers to:

  • Eavesdrop on queries and see which sites users visit

  • Manipulate DNS responses for malicious purposes

Both DoT and DoH solve this problem by encrypting communication between DNS clients and resolvers, protecting the privacy and integrity of DNS queries.

DNS over TLS (DoT)

  • Established in 2016

  • Encrypts DNS traffic over a dedicated port (853) instead of the standard port 53

  • After a secure TLS handshake, DNS queries and responses flow through a persistent encrypted channel

  • Connection setup usually takes 5–10 seconds and remains active for subsequent queries

Key takeaway: DoT operates at the Transport Layer and encrypts DNS traffic for the entire operating system once configured.

 

 

DNS over HTTPS (DoH)

  • Introduced in 2018

  • Encrypts DNS queries inside regular HTTPS traffic over port 443

  • Looks like standard HTTPS traffic, making it harder for network devices to block

  • Responses are encrypted and decoded by the client application

Key takeaway: DoH operates at the Application Layer and is often configured on a per-application basis (e.g., browsers like Firefox, Chrome, Opera).

 

 

Differences between DoT and DoH

  DNS-over-TLS DNS-over-HTTPS
Port Opens a new port (853) for creating a secure connection for encrypted communication Reuses the HTTPS port 443 for encrypted communication
OSI Layer of operation Encrypted communication takes place at the Transport Layer (layer 4) of the OSI model Encrypted communication takes place at the Application Layer (layer 7) of the OSI model
Operating System / Application Coverage It is either supported natively or can be configured for various operating systems (macOS, Windows, and Linux). Once in place, it encrypts DNS communication for any application that uses DNS on the operating system Needs to be configured for each application/client that needs to use it (e.g. browsers like Firefox, Google Chrome, Opera, etc)
Packet Size Because it operates at a lower level, its packet sizes are light Packet sizes are larger than DoT because it operates at the Application layer (two layers above DoT)
Latency Minimal latency in DNS requests Higher latency compared to DoT

Using DoT and DoH with DNSFilter

  • DoT with DNSFilter

  • DoH with DNSFilter

    • Supported via Network Deployments as well as some client applications

    • Because DoH runs over port 443, it can bypass traditional DNS controls if unmanaged

    • Administrators can block or control access to third-party DoH endpoints. DNSFilter maintains a community list of DoH resolvers to help enforce policies

Was this article helpful?
7 out of 9 found this helpful
Return to top

Comments

0 comments

Please sign in to leave a comment.