GLOSSARY · DNS OVER TLS
DoT
DNS over TLS encrypts DNS traffic between your device and a resolver using the same TLS security that protects websites, as set out in RFC 7858. It runs on its own dedicated port, 853, so the traffic is clearly separate from other connections.
Why it matters
Like DoH, DoT stops people on the network from reading or altering your lookups. Its dedicated port makes it easy for network administrators to manage, and equally easy for a network to block, which is a difference from DoH, where the traffic blends in with web browsing. The resolver at the far end still sees your queries.
In practice
DoT is commonly used at the operating system or router level. Android's Private DNS setting uses DoT, and some routers can forward all lookups over it. If a network blocks port 853, devices may fall back to unencrypted DNS or fail, depending on how they are set up. Strict and opportunistic modes behave differently.
Related terms
- DoH: DNS over HTTPS wraps DNS questions and answers inside ordinary encrypted HTTPS traffic to a resolver, as described in RFC 8484.
- DNS: DNS is the internet's naming system.
- DNS resolver: A DNS resolver is the server that does the lookup work on your behalf.
- Port: A port is a number from 0 to 65535 that tells a computer which program should receive incoming network data.