Browser privacy
DNS-over-HTTPS (DoH) vs DNS-over-TLS (DoT): Privacy Benefits & Trade-offs
How encrypted DNS protocols protect your browsing history from ISP snooping and coffee shop man-in-the-middle attacks.
Traditional Domain Name System (DNS) queries are transmitted across the internet in completely unencrypted plain text via UDP port 53. Whenever you navigate to a website, your internet service provider (ISP), local Wi-Fi router administrators, and eavesdroppers on public networks can observe and log every domain you visit.
Encrypted DNS protocols — specifically DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) — encrypt queries between your device and the resolver.
Comparing DoH and DoT
| Feature | DNS-over-HTTPS (DoH) | DNS-over-TLS (DoT) |
|---|---|---|
| Standard Port | 443 (Standard HTTPS) | 853 (Dedicated DNS-TLS) |
| Censorship Evasion | Excellent (indistinguishable from web traffic) | Moderate (easily blocked by port filters) |
| Primary Deployment | Web browsers (Chrome, Firefox) | Operating system level (Android, Linux) |
| Performance | Minimal HTTP/2 multiplexing overhead | Lower connection overhead |
Recommended Resolvers with Strict Privacy Charters
Avoid unencrypted ISP default DNS. Configure fast, audited privacy-first resolvers:
- Cloudflare (1.1.1.1): High speed with audited zero-logging of personal IP addresses.
- Quad9 (9.9.9.9): Swiss-headquartered nonprofit resolver that blocks known malicious malware and phishing domains.
- NextDNS: Provides customizable parental controls, ad-blocking, and telemetry tracking prevention.
Sources
Frequently asked questions
- What is the difference between DoH and DoT?
- DoH (DNS-over-HTTPS) wraps DNS queries inside standard HTTPS port 443 traffic, making it blend with normal web traffic, while DoT (DNS-over-TLS) uses a dedicated port 853.
- Does encrypted DNS hide which websites you visit from your ISP?
- Encrypted DNS hides domain resolution queries, but ISPs can still observe IP destination addresses and unencrypted SNI (Server Name Indication) handshakes unless Encrypted Client Hello (ECH) is also active.
About the author
Written by the LockdownGuide Editorial Team, which researches and maintains every guide on this site. Read more about our editorial standards or contact us with corrections.
Keep reading
Zero Trust Architecture for Small Business: How to Move Beyond Legacy VPNs
How SMBs can implement modern Zero Trust Network Access (ZTNA) to grant least-privilege access without cumbersome legacy VPNs.
Read the guide →SIM Swapping Attacks: How Attackers Steal Numbers & How to Lock Your Carrier
How SIM swapping works, how attackers bypass SMS two-factor authentication, and step-by-step instructions to set carrier account lock PINs.
Read the guide →Securing Home Routers and IoT Devices: The Remote Worker Hardening Guide
How to segment smart home IoT gadgets from corporate work computers using VLANs and guest Wi-Fi networks.
Read the guide →