Home/ Glossary/ DNS over TLS

DNS over TLS (DoT)

Security Glossary - DNS

Definition: DNS over TLS (DoT) encrypts DNS queries by wrapping them in a TLS connection on port 853. Like DNS over HTTPS, it prevents network observers from seeing which domains are being queried. DoT is more commonly used by operating systems and network-level resolvers, while DoH is more common in browsers.

The Importance of DoT

DoT provides the same privacy benefits as DoH - encrypting DNS queries so network observers cannot monitor domain lookups. The main difference is implementation: DoT uses a dedicated port (853) with a standard TLS connection, making it easier for network administrators to identify and manage DNS traffic separately from web traffic.

For website operators, DoT is relevant primarily as a DNS infrastructure choice. If you run your own recursive resolver or configure DNS for an organization, DoT between your resolver and upstream providers protects query privacy. Android 9+ supports DoT natively as "Private DNS" in settings.

The choice between DoH and DoT is mostly a network architecture decision. DoT is easier to distinguish and manage at the network level (since it uses a dedicated port), while DoH blends with regular HTTPS traffic (making it harder to block but also harder to manage). Both provide equivalent privacy protection.

How to Verify

DoT is configured at the client or resolver level, not the website level. Verify your DNS resolver supports DoT if privacy is a priority for your infrastructure. As a site operator, your DNS records should work identically whether clients use plain DNS, DoT, or DoH.

See how your site handles DoT

Check DNS Health

DoT FAQ

Should I use DoT or DoH?
For browsers, DoH is more common and widely supported. For system-level or network-level DNS encryption, DoT is often preferred because it uses a dedicated port that is easier to manage. Both provide equivalent privacy protection for DNS queries.
Does DoT protect against DNS spoofing?
DoT protects against eavesdropping and tampering on the connection between the client and the resolver. However, it does not protect against a compromised resolver returning false data. For that, DNSSEC is needed to verify the authenticity of DNS responses.

Related Concepts

Domain Name System DNS over HTTPS Transport Layer Security DNS Security Extensions Nameserver
Disclaimer: DomainOptic provides automated informational scans only. Results do not constitute professional security advice, compliance certification, or a guarantee of security. Always verify findings independently.