Comparison diagram showing DNS over TLS and DNS over HTTPS encryption paths

Domain Security

DNS over TLS vs DNS over HTTPS: What Is the Difference and Which Should You Use?

Domain 360 Team

·July 8, 2026·6 min read

Unencrypted DNS is a plain-text protocol that anyone between your device and the resolver can read and potentially manipulate. DoT and DoH both solve this — but with different approaches that suit different situations.

What's the Core Difference? The Port

Both protocols use TLS encryption. The difference is where they run.

DNS over TLS (DoT) uses dedicated port 853. This makes it identifiable on the network — a network administrator or ISP can see that port 853 traffic exists, meaning encrypted DNS is being used, even though they cannot see what domains are being queried. The port-based identification makes DoT easy to filter or block.

DNS over HTTPS (DoH) uses port 443 — the same port as all HTTPS web traffic. DNS queries are wrapped in HTTPS and look identical to any other secure web connection. Networks cannot distinguish DoH DNS traffic from web browsing traffic without deep packet inspection.

DoT vs DoH: What's the Difference at a Glance?

	DNS over TLS (DoT)	DNS over HTTPS (DoH)
Port	853 (dedicated)	443 (shared with HTTPS)
Network visibility	Identifiable as DNS traffic	Blends in with web traffic
Best for	Network admins wanting DNS visibility	Individuals wanting ISP-level privacy
Native OS support	Android 9+ (Private DNS), Linux (systemd-resolved)	Windows 11, macOS/iOS (via app/profile), most browsers
Easier to block	Yes — port-based	No — requires deep packet inspection

What Are the Privacy Trade-offs?

For individual users seeking privacy from ISP monitoring, DoH provides stronger coverage. An ISP monitoring port 853 knows you are using encrypted DNS. The same ISP monitoring port 443 traffic cannot determine whether you are browsing the web or making DNS queries.

For network administrators managing organisational security, DoT is preferable — it allows visibility into DNS usage patterns (which resolvers are being used, how much traffic) while still being encrypted. DoH's blending into general HTTPS traffic makes it harder to audit and control.

This difference drove some of the resistance to browser-based DoH adoption from ISPs and enterprise networks — it reduced their visibility into DNS activity in ways they were not prepared for.

Which Devices Support Each Protocol?

DoT support: Android 9+ via Private DNS setting (Settings, Network and internet, Private DNS, enter hostname like one.one.one.one) Linux with systemd-resolved configured for DoT Routers with custom firmware (OpenWrt, etc.)

DoH support: Chrome, Firefox, Edge, Brave — all implement DoH independently in browser settings Windows 11 — native DoH in network settings macOS and iOS via configuration profiles or the Cloudflare 1.1.1.1 app Android via DoH-supporting browsers (not the OS-level Private DNS setting, which uses DoT)

How Do Browsers Handle DoH?

An important nuance: when Chrome or Firefox implement DoH in their settings, it operates independently of the operating system DNS configuration. A device might have DoT configured at the OS level via Android Private DNS, while Chrome simultaneously uses DoH for its own DNS queries.

The browser DoH operates at the application level. It does not cover DNS queries from other applications — the OS-level encrypted DNS setting covers everything.

Which Should You Configure?

Android: Use Private DNS with DoT — built-in, easy, covers all apps. Enter one.one.one.one for Cloudflare or dns.quad9.net for Quad9.

Windows 11: Enable DoH in network settings. Covers OS-level DNS for all applications.

macOS/iOS: Use the 1.1.1.1 app or a DNS configuration profile for system-wide DoH.

Browsers: Enable DoH in browser settings as an additional layer — covers browser traffic even if OS DNS is unencrypted.

Routers: Check firmware support. Most consumer routers do not support DoT or DoH natively. Custom firmware options exist.

For the detailed setup process on each platform, our guide to Private DNS and DNS over HTTPS covers every device in step-by-step detail.

Quick Answers

What is DNS over TLS (DoT)?

DNS over TLS (DoT) encrypts DNS queries using TLS encryption on dedicated port 853. It keeps DNS traffic separate from other encrypted traffic on the network. The dedicated port makes DoT easy to identify and monitor, which allows network administrators to see that DNS is being used (though not which domains are queried). Android Private DNS uses DoT.

What is DNS over HTTPS (DoH)?

DNS over HTTPS (DoH) encrypts DNS queries inside standard HTTPS traffic on port 443 — the same port used for all secure web browsing. This makes DNS queries indistinguishable from regular web traffic. DoH is harder for networks to block or monitor, which is why browsers adopted it as their approach to encrypted DNS.

Which is better for privacy: DoT or DoH?

DoH offers stronger network-level privacy because DNS traffic is indistinguishable from other HTTPS traffic. Networks cannot block or shape DNS without blocking all HTTPS, and passive monitoring cannot identify DNS traffic. DoT is easier for network administrators to monitor (they can see port 853 traffic). For individual privacy, DoH is generally better.

Which devices support DNS over TLS vs DNS over HTTPS?

Android 9+ supports DoT via the Private DNS setting. iOS and macOS support DoH via configuration profiles or the 1.1.1.1 app. Windows 11 supports DoH natively in network settings. Browsers (Chrome, Firefox, Edge) implement DoH independently of the operating system. Routers rarely support DoT or DoH natively without custom firmware.

Does using DoT or DoH improve internet speed?

Neither meaningfully improves or reduces internet speed. The encryption adds minimal overhead. DNS lookup speed is determined primarily by the resolver's infrastructure and proximity — choosing a fast resolver like 1.1.1.1 improves DNS speed regardless of whether DoT or DoH is used.

Never lose a domain again

Track every domain you own in one dashboard. Free for up to 15 domains.