DNS over HTTPS and TLS
A normal DNS query crosses the network in plain text — anyone on the path can read which sites you look up, and some will tamper with the answers. DoH and DoT wrap those queries in encryption.
DNS traffic has historically been the one unencrypted thing left — even on an HTTPS-everywhere network, the lookups that precede each connection travel in the clear. DoT and DoH fix that by encrypting the query between the client and the resolver.
DoT and DoH, the difference
- DoT — DNS over TLS, on its own port (853). Easy to see and manage on a network; clearly ‘DNS, encrypted’.
- DoH — DNS over HTTPS, on 443, indistinguishable from web traffic. Harder to block, harder to observe.
What it does and does not hide
Encrypted DNS stops people on the path — the coffee-shop network, an upstream snoop — from reading or rewriting your lookups. It does not hide anything from the resolver you use; that server still sees every query. So the question becomes whose resolver you trust — which is a good reason to run your own.
Offer it from your own resolver
If you run a resolver for your machines or your users, giving it a DoT or DoH endpoint means those queries are both private on the wire and answered by a resolver you control. That is the strongest position: encrypted in transit, and not handed to a third party.
The operational catch
DoH on 443 is invisible to the network, which is exactly why some find it awkward — it can bypass local DNS policy and internal split-horizon names. On a network where you rely on DNS to route or filter, decide deliberately whether applications should be doing their own DoH behind your back.
Certificates, as ever
Both DoT and DoH are TLS, so your resolver endpoint needs a valid certificate and sensible settings — see TLS certificates and hardening TLS.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base