DNS over HTTPS vs DNS over TLS: Comparing Encrypted DNS

Two competing standards for encrypting DNS queries, and the practical differences between them.

Core Concept

DNS over HTTPS (DoH) and DNS over TLS (DoT) both encrypt DNS queries in transit, preventing on-path observers from seeing which domains a user is resolving.

Traditional DNS queries travel in plaintext, making them visible to anyone positioned on the network path — both protocols address this gap using different transport approaches.

Insight: Both DoH and DoT solve the same core problem — plaintext DNS visibility — but package the encrypted query differently at the transport level.

How DoT Works

DNS over TLS wraps standard DNS queries in a TLS-encrypted connection, typically over a dedicated port.

Uses port 853, distinct from standard DNS traffic
Easily identifiable and blockable as DNS traffic by network operators
Straightforward to implement alongside existing DNS infrastructure

Clearly Identifiable Traffic

Because DoT runs on its own dedicated port, network administrators can identify and selectively block it far more easily than DoH.

How DoH Works

DNS over HTTPS embeds DNS queries within standard HTTPS traffic, typically over port 443.

Uses the same port as regular web traffic
Blends in with other HTTPS traffic, harder to selectively block
Often implemented directly in browsers rather than the OS

Limitation: DoH's traffic-blending advantage is also a governance concern for network administrators who rely on visibility into DNS queries for security monitoring.

The Governance Debate

DoH's difficulty to distinguish from regular traffic has made it more contentious than DoT among network operators and enterprises.

Organizations that rely on DNS-level filtering for security or content policy find DoH more disruptive, since it can bypass network-level DNS controls entirely if configured at the browser level.

Bypassing Network Controls

Browser-level DoH can route DNS queries around an organization's network-level filtering entirely, which is why many enterprises actively manage or disable it.

Choosing Between the Two

The right choice depends heavily on the deployment context.

DoT fits well for OS-level or router-level deployment
DoH suits browser-level privacy for individual users
Enterprises often prefer DoT for easier network visibility

Insight: For enterprise environments needing visibility, DoT's identifiable traffic pattern is often preferable despite offering the same core encryption as DoH.

Real-World Implementation

Both protocols have seen substantial adoption across different parts of the ecosystem.

Major browsers offering DoH by default or as an option
Operating systems increasingly supporting DoT natively
Enterprise DNS filtering tools adapting to manage encrypted DNS

Encrypted DNS closes a real privacy gap, but its rollout has required real adjustments to how network-level DNS visibility and filtering work.

Common Mistakes to Avoid

A few common mistakes come up when organizations plan for encrypted DNS.

Assuming DoH and DoT provide identical operational characteristics simply because both encrypt DNS.
Failing to account for browser-level DoH bypassing network-level DNS filtering.
Blocking encrypted DNS entirely without considering the legitimate privacy benefits it provides.
Not updating network monitoring tools to account for encrypted DNS traffic patterns.
Assuming DoT is unblockable simply because it's encrypted, despite running on an identifiable port.
Assuming all operating systems support DoT and DoH equally well.
Overlooking application-level DoH implementations separate from OS or browser-level settings.
Failing to consider performance differences between the two protocols under specific network conditions.
Overlooking Oblivious DoH as an emerging privacy enhancement beyond standard DoH.
Assuming corporate network policies automatically block all forms of encrypted DNS.
Failing to test application compatibility with encrypted DNS before wide deployment.
Overlooking regional differences in ISP support for encrypted DNS protocols.

Best Practices Checklist

These practices help organizations manage encrypted DNS deliberately.

Choose DoT for network-level deployments where DNS visibility for filtering matters.
Choose DoH for browser-level privacy needs where blending into HTTPS traffic is preferred.
Update network monitoring and filtering tools to account for encrypted DNS traffic.
Establish clear policy on browser-level DoH usage within managed enterprise environments.
Test how encrypted DNS interacts with existing DNS-based security controls before wide rollout.
Verify OS and browser-level support before planning an encrypted DNS rollout.
Account for application-level DoH implementations that may bypass system-wide settings.
Test performance under realistic network conditions before choosing between DoH and DoT.
Track emerging privacy enhancements like Oblivious DoH as the space continues to evolve.
Verify corporate network policy explicitly rather than assuming encrypted DNS is blocked by default.
Test application compatibility with encrypted DNS thoroughly before a wide rollout.
Research regional ISP support differences when planning an encrypted DNS deployment for a global audience.

Frequently Asked Questions

Frequently asked questions about DNS over HTTPS and DNS over TLS.

Which is more private, DoH or DoT?

Both encrypt DNS queries similarly, but DoH's traffic blends in with regular HTTPS traffic, making it harder for network observers to identify.

Can my organization block DoH?

It's more difficult than blocking DoT, since DoH traffic looks like ordinary HTTPS traffic on the standard web port.

Why would an enterprise prefer DoT over DoH?

DoT's identifiable traffic pattern makes it easier to manage and monitor at the network level, which matters for organizations relying on DNS-level visibility.

Does encrypted DNS protect against all forms of tracking?

It protects the DNS query itself from network-level observation, but doesn't address other tracking methods unrelated to DNS resolution.

Is encrypted DNS widely supported today?

Yes — major browsers and operating systems increasingly support DoH and DoT, though enterprise adoption and policy vary.

Do all operating systems support encrypted DNS equally?

Support varies, with some operating systems offering more mature native DoT or DoH implementations than others.

Can individual applications implement DoH separately from the OS?

Yes — some applications implement their own DoH resolver settings, which can operate independently of system-wide DNS configuration.

Is there a meaningful performance difference between DoH and DoT?

Performance can vary based on network conditions and implementation, making real-world testing worthwhile before committing to one over the other.

What is Oblivious DoH?

An emerging enhancement that further separates who sent a DNS query from what was queried, adding privacy beyond standard DoH.

Do corporate networks automatically block encrypted DNS?

Not automatically — this depends entirely on specific network policy, which should be explicitly verified rather than assumed.

Does ISP support for encrypted DNS vary by region?

Yes — adoption and support differ globally, making regional research worthwhile for services with an international audience.

Check DNS Encryption Support

Run a DNS analysis to see a domain's resolver and encryption capabilities.

Launch Tool →