DoT
What is DoT?
DoT (DNS over TLS) encrypts DNS queries and responses over a dedicated TLS connection, usually on port 853, keeping DNS traffic separate from ordinary HTTPS traffic rather than blending into it like DoH does. AdminKit's DNS resolver test walks you through checking which resolver your connection actually uses.
By AdminKit team, Netbase JSC · Updated
DoT (DNS over TLS) encrypts DNS queries and responses using TLS over a dedicated port, 853 — registered as domain-s in IANA’s Service Name and Transport Protocol Port Number Registry — separate from ordinary DNS traffic on port 53. It serves the same privacy and integrity goal as DoH — preventing on-path observation or tampering with DNS lookups — but keeps DNS traffic on its own recognizable port rather than blending it into regular HTTPS traffic, which makes it easier for network administrators to identify and manage deliberately, at the cost of being easier to block outright. DoT is defined in RFC 7858 and is commonly supported by operating-system DNS settings and some router firmware; usage guidance for DoT and DoH clients is in RFC 8310. Google Public DNS’s DoT documentation explains what those profiles mean for a client: under strict privacy, failing to establish a secure TLS connection on port 853 is a hard error with no DNS service, while under opportunistic privacy the client falls back to unencrypted DNS on port 53. DoQ (DNS-over-QUIC) reuses DoT’s port 853 but carries queries over QUIC instead of TLS-over-TCP, avoiding the head-of-line blocking a single stalled DoT connection can cause. Because DoT already encrypts the connection, it’s also safe to combine with EDNS(0) Padding, which rounds each query to a fixed size so its length doesn’t separately leak which domain is being looked up.
AdminKit groups doT under its DNS cluster — browse the AdminKit glossary index for other related terms.
Frequently asked questions
Is DoT the same as DoH?
They share the same goal -- encrypting DNS queries -- but DoT uses its own dedicated port, 853, kept separate from ordinary DNS traffic, while DoH blends encrypted queries into regular HTTPS traffic on port 443.
Is DoT easier to block than DoH?
Yes -- because DoT runs on its own recognizable port, a network administrator can block or manage it deliberately, whereas blocking DoH usually means blocking HTTPS traffic generally, since it's indistinguishable from other HTTPS on the wire.
Does DoT protect the content of my DNS queries from my ISP?
Yes -- DoT encrypts the query and response over TLS, so an ISP or on-path observer can see that a DNS lookup happened but not which domain was being looked up.
Can DoT be combined with other DNS privacy techniques?
Yes -- because DoT already encrypts the connection, it's safe to combine with EDNS(0) Padding, which rounds each query to a fixed size so its length doesn't separately leak which domain is being looked up.