Why encrypt DNS?
DNS translates names such as example.com into IP addresses. Traditional DNS is often sent without encryption between a device and its recursive resolver. Someone controlling the local network may be able to observe or modify those queries. DNS over HTTPS (DoH) and DNS over TLS (DoT) protect that connection with encryption.
Both protocols normally send the same DNS questions and receive the same DNS answers. The main difference is how the encrypted transport is carried and managed.
DoH and DoT compared
| Feature | DNS over HTTPS | DNS over TLS |
|---|---|---|
| Typical transport | HTTPS, usually port 443 | Dedicated TLS, usually port 853 |
| Traffic visibility | Blends with ordinary HTTPS | Easier for network administrators to identify |
| Browser support | Common in modern browsers | Usually configured by OS, router, or resolver software |
| Network policy | Can bypass local DNS policy if the browser selects its own resolver | Easier to allow, block, or route as a distinct service |
| DNS semantics | Same DNS records | Same DNS records |
Neither protocol is universally faster. Performance depends on resolver distance, connection reuse, caching, network congestion, and implementation quality. A nearby reliable resolver often matters more than the protocol name.
What encrypted DNS does not hide
DoH and DoT protect queries between your device and the selected resolver. The resolver still sees the questions and must contact authoritative DNS infrastructure or use cached answers. The destination IP is also visible to the network when the later connection begins. Encrypted DNS is therefore a privacy improvement, not complete anonymity.
Malware can also use encrypted DNS. Organizations may require managed resolvers for threat blocking, parental controls, legal compliance, or internal names. A browser that silently chooses a different public resolver can break those controls. Good enterprise deployments publish clear policy rather than simply disabling encryption.
What about Oblivious DoH?
Oblivious DNS over HTTPS adds a relay so the resolver handling the query does not directly receive the client's IP address. The relay sees the client connection but not the plaintext query, while the resolver sees the query but receives it from the relay. This reduces the amount of information held by one party, though it requires compatible infrastructure.
How to choose
- Home user: use the operating system or browser's supported encrypted DNS with a resolver you trust.
- Managed business: use a controlled resolver and a documented DoH/DoT policy so security logging and internal domains continue to work.
- Router deployment: DoT is often straightforward when the router forwards all household DNS to one encrypted upstream.
- Restricted network: DoH may connect where port 853 is blocked, but bypassing a network policy can violate terms or create support problems.
- VPN user: confirm whether the VPN supplies its own resolver and whether custom encrypted DNS would leak requests outside the tunnel.
Use the DNS lookup tool to inspect public records. Remember that a record lookup and a resolver-leak test answer different questions.
Frequently asked questions
Does DoH change my public IP?
No. It changes how DNS queries reach a resolver, not the public address used for website traffic.
Can my provider still see which sites I visit?
Encrypted DNS removes one clue, but destination IP addresses and traffic patterns may still reveal information.
Should I use DoH and DoT at the same time?
Usually one configured path is enough. Multiple layers can create confusing resolver behavior.
Does encrypted DNS stop phishing?
Not by itself. A protective resolver may block known malicious domains, but users still need browser warnings and careful verification.
Standards reference: DoH and DoT are standardized by the IETF; resolver privacy also depends on operational policy and retention.