# DNS over HTTPS (DoH) vs\. DNS over TLS (DoT): Mechanisms and Trade\-offs Both DoH and DoT encrypt DNS queries to protect user privacy, but they operate at different layers of the network stack\. Understand the practical impact of port 443 versus port 853 on visibility and firewalling\. ![Conceptual comparison of a dedicated DNS channel and DNS mixed with general HTTPS traffic\.]() Traditional Domain Name System (DNS) queries are transmitted in plaintext via UDP\. This allows any party with network visibility—such as an Internet Service Provider (ISP) or a malicious actor—to monitor a user's browsing behavior by observing which domains are being resolved\. To address this lack of confidentiality, two primary standards were developed: DNS over TLS (DoT) and DNS over HTTPS (DoH)\. ## The Mechanism of DNS over TLS (DoT) DNS over TLS (DoT) encrypts DNS queries by wrapping the DNS protocol directly within a Transport Layer Security (TLS) tunnel\. While standard DNS uses UDP, DoT establishes a secure connection to the resolver using TLS, ensuring that the requests and responses cannot be read or tampered with by on\-path attackers\. From a network architecture perspective, DoT is distinct because it operates on a dedicated port: TCP port 853\. Because it uses a specific port reserved solely for encrypted DNS, the traffic is easily identifiable to network administrators and security appliances\. This allows an organization to monitor the volume of encrypted DNS traffic or block it entirely to force clients back to a managed internal resolver\. ## The Mechanism of DNS over HTTPS (DoH) DNS over HTTPS (DoH) takes a different approach by embedding DNS queries within the HTTP protocol\. Rather than creating a dedicated DNS tunnel, DoH maps each DNS query\-response pair into a standard HTTP exchange\. It utilizes the application/dns\-message media type to convey the DNS wire format within the HTTP body or as a base64url\-encoded parameter in a GET request\. DoH is designed to integrate with existing web infrastructure\. It leverages standard HTTP features such as caching, compression, and proxying\. Most importantly, DoH operates on TCP port 443, the same port used by almost all HTTPS web traffic\.  ## Practical Comparison: Visibility vs\. Privacy The fundamental difference between DoT and DoH is not the encryption itself—both use TLS—but how that encryption is presented to the network\. This leads to a significant trade\-off between network manageability and user privacy\. ### Network Visibility and Control DoT is often preferred by network security teams\. Because DoT traffic is isolated to port 853, administrators can identify it without inspecting the encrypted payload\. This visibility is critical for enforcing security policies, such as blocking known malicious domains via a corporate DNS filter\. If a device attempts to use DoT to bypass these filters, the administrator can simply block port 853\. ### Privacy and Camouflage DoH is designed for maximum privacy\. Because DoH traffic is mixed with standard HTTPS traffic on port 443, it is virtually indistinguishable from normal web browsing to a network observer\. This "camouflaging" effect prevents network administrators or ISPs from easily identifying or blocking DNS queries without blocking all HTTPS traffic to that specific resolver\. This makes DoH a powerful tool for users in environments where DNS\-based censorship is prevalent\. ## DoT/DoH vs\. DNSSEC It is common to confuse encrypted DNS (DoT/DoH) with DNS Security Extensions (DNSSEC)\. However, they solve entirely different problems: • DoT and DoH provide Confidentiality: They encrypt the "last mile" between the client and the resolver, preventing eavesdropping\. • DNSSEC provides Integrity: It uses digital signatures to verify that the DNS data returned by the authoritative server is authentic and has not been forged\. DNSSEC does not encrypt the query or the response; it only proves the data is correct\. In a fully secure deployment, both are used together: DNSSEC ensures the answer is true, and DoH or DoT ensures the request remains private\. ## Sources [Cloudflare: DNS over TLS vs\. DNS over HTTPS]() [ICANN SSAC: SAC109 — The Implications of DNS over HTTPS and DNS over TLS]()