Web Protocols

DNS over HTTPS (DoH) & DNS over TLS (DoT)

Two ways to encrypt DNS so queries cannot be read or altered in transit: DoH tunnels DNS inside HTTPS on port 443, while DoT uses a dedicated TLS connection on port 853.

What it is

Classic DNS is plaintext, so anyone on the path can see and tamper with lookups. DNS over TLS (DoT, RFC 7858) wraps queries in TLS on port 853. DNS over HTTPS (DoH, RFC 8484) sends them as HTTPS requests on port 443, making the DNS traffic indistinguishable from ordinary web traffic and hard to block.

DoH vs DoT

DoT is easy for network operators to see and manage on its own port; DoH blends into HTTPS, maximising privacy but reducing network-level visibility. Both stop passive DNS snooping.

Why it matters

  • Encrypted DNS prevents on-path snooping and manipulation of which sites you visit.
  • It closes a long-standing privacy gap left by plaintext DNS.

Common mistakes

  • Assuming HTTPS alone hides your browsing — without encrypted DNS the hostname still leaks in the query.
  • Confusing encrypted transport with trust in the resolver, which still sees every query.

How WebInspect checks this

  • The Network Inspector reports DNS resolution details and resolver behaviour relevant to encrypted DNS.