DNS over HTTPS (DoH) and DNS over TLS (DoT) Explained

You can hide which sites you are about to visit starting from the very first step — the DNS lookup.

Why a Plain DNS Lookup Can Be Exposed

Ordinary DNS queries travel as unencrypted plaintext (typically over UDP port 53), so a browser's first step in visiting a site — resolving a domain name into an IP address — can be seen by anyone positioned in between. That means another device on the same network, or your ISP, can easily see which domains you are looking up, and in theory an attacker could even inject a forged response pointing to a different IP address.

What Is DoH (DNS over HTTPS)?

DoH wraps a DNS query inside HTTPS and sends it over port 443 — the same channel used for regular web traffic — which makes DoH traffic hard to distinguish from normal HTTPS at a glance. Chrome, Firefox, Edge, and other major browsers support DoH in their own settings, and public DNS providers like Cloudflare (1.1.1.1) and Google (8.8.8.8) offer DoH endpoints.

What Is DoT (DNS over TLS)?

DoT also encrypts DNS queries with TLS, but instead of sharing port 443 with regular HTTPS traffic, it uses a dedicated port, 853. That makes it comparatively easier for a network administrator to identify DoT traffic separately and apply policy to it than DoH traffic. Android's "Private DNS" setting is a well-known example of DoT support.

The Key Difference Between DoH and DoT

Both encrypt DNS queries to prevent eavesdropping and tampering, so their goal is identical — the difference is in transport. DoH blends into ordinary web traffic, making it hard for a network administrator to filter or block DNS traffic specifically, while DoT uses a separate port that is easier to allow or block by policy on corporate or school networks. As a result, corporate IT departments tend to favor DoT, while privacy-focused individual users tend to favor DoH.

Benefits and Limits of Encrypted DNS

DoH and DoT are effective at hiding which domains you are looking up from a third party like an ISP or public Wi-Fi operator, but they do not fully hide the actual IP address or SNI (Server Name Indication) information exchanged once you connect to that server. Also, if a school, workplace, or router has a policy of blocking certain sites via DNS, a device using DoH can end up bypassing that block — which is exactly why some network administrators see it as a headache rather than a benefit.

How to Turn It On

In Chrome, go to Settings > Privacy and security > Security, turn on "Use secure DNS," and pick a provider like Cloudflare or Google. In Firefox, enable "DNS over HTTPS" under network settings. On Android, go to Settings > Network > Private DNS and enter the hostname of a DoT-supporting server (for example, dns.google) to encrypt DNS lookups for the whole device.

Want to change your DNS server directly?

If you just want to switch to a different public DNS server without encryption, that is a simpler, separate setting worth learning on its own.

Curious about DNS record types?

If you are curious about the DNS records themselves — A, CNAME, MX, and the rest — that is a good complementary topic to this one.

Frequently Asked Questions

Does turning on DoH slow down my internet?

It adds an encryption and decryption step, but modern devices handle that quickly enough that it is rarely noticeable. That said, if the DoH server you are using is physically far away, you may notice a small delay on the very first connection.

Is using DoH a problem on a work or school network?

If your workplace or school restricts access to certain sites via DNS blocking, a device using DoH may end up bypassing that restriction. That is why some organizations apply separate policies to specifically block or limit DoH traffic on their own networks.