DoH vs DoT: Which Encrypted DNS Should You Use?

What They Have in Common

Plain DNS sends your lookups in readable form, so anyone on the path can see which sites you ask for. DoH and DoT both wrap the lookup in encryption between your device and the resolver. Neither one hides your lookups from the resolver itself. See DNS privacy for the basics.

DNS over HTTPS (DoH)

Sends lookups inside ordinary HTTPS on port 443, mixed in with normal web traffic. That makes it hard for a network to single out and block. Browsers such as Firefox and Chrome support it, and iOS can use it through a configuration profile. The tradeoff is that an app can use DoH without the system knowing, which can bypass network-level filtering.

DNS over TLS (DoT)

Uses its own port, 853. That makes it easy for a network to see and block, but also easy for an administrator to manage and monitor. Android supports it natively as Private DNS. Because DoT runs over TCP, it also works through tunnels that carry TCP only.

Which to Use

Do Not Stack It on a VPN

If a VPN already sends your DNS through its own resolver, adding a separate DoH or private DNS setting can override it and cause leaks, or stall pages on tunnels that drop UDP. See DNS leaks. Pick one DNS path and keep it.

Common Questions