How do DNS over HTTPS (DoH) and DNS over TLS (DoT) actually work?

Question

I've been reading more about online privacy and keep seeing DNS over HTTPS and DNS over TLS mentioned as ways to make DNS queries more secure. I understand that regular DNS is plain text, but I'm getting a bit lost in the technical details of how these two protocols function differently. I've tried looking at a few articles, but they often jump straight into advanced concepts. Could someone break down in simple terms how DoH and DoT actually work to encrypt the requests? For example, what ports do they use and how does the client initially connect to the resolver?

admin · Accepted Answer

Both DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt DNS queries by tunneling them through secure, established protocols, but they differ in their network layer and port usage. DoT operates by wrapping DNS packets within a TLS encryption tunnel, exclusively using port 853, which makes it identifiable but separate from regular web traffic. In contrast, DoH sends DNS queries as HTTPS POST or GET requests on port 443, blending them with regular web traffic and making them indistinguishable from other encrypted web data. The client initially connects to a resolver supporting either protocol by establishing a standard TLS handshake, verifying the server's certificate for authenticity. For example, configuring a DoT client involves specifying the resolver's hostname and port:

server:

  dns-over-tls: yes

  server-address: 1.1.1.1@853

  server-name: cloudflare-dns.com

The underlying concept leverages TLS encryption to protect query privacy, preventing eavesdropping or manipulation by intermediaries, with DoH adding the benefit of obfuscation within common HTTPS traffic.

server:
  dns-over-tls: yes
  server-address: 1.1.1.1@853
  server-name: cloudflare-dns.com

The underlying concept leverages TLS encryption to protect query privacy, preventing eavesdropping or manipulation by intermediaries, with DoH adding the benefit of obfuscation within common HTTPS traffic.

How do DNS over HTTPS (DoH) and DNS over TLS (DoT) actually work?

Who Is Online