What is DoT?

DNS over TLS (DoT) is a network security protocol that wraps standard DNS queries and responses in a Transport Layer Security (TLS) tunnel. By running DNS inside a dedicated TLS session on port 853, DoT ensures that the entire DNS transaction is encrypted and authenticated, protecting against passive eavesdropping and active manipulation by intermediaries such as ISPs or attackers on the local network.

DoT differs from DNS over HTTPS (DoH) primarily in its transport layer. DoT operates on a well-known port (853) and uses TLS directly on top of TCP, whereas DoH tunnels DNS inside HTTP/2 or HTTP/3 traffic on port 443, making it harder to differentiate from regular web traffic. DoT requires a separate connection establishment and is often deployed alongside a recursive resolver that listens on both port 53 (unencrypted) and port 853. The client and resolver negotiate TLS, verify the server certificate (typically via a pre-configured trust anchor or a pinned certificate), and then exchange DNS messages over a persistent encrypted channel.

In the protocol stack, DoT sits between the DNS application layer and the TCP/TLS transport layer. It is formally defined in RFC 7858 (published May 2016) and RFC 8310 (usage profiles). Stub resolvers on end-user devices, such as mobile phones and PCs, commonly support DoT to query a trusted recursive resolver like Cloudflare (1.1.1.1), Quad9 (9.9.9.9), or Google Public DNS (8.8.8.8). Operators and enterprise networks may deploy DoT forwarders to secure internal DNS traffic to external resolvers, reducing the risk of DNS spoofing and privacy leaks.