DNS over TLS (DoT)

DNS over TLS (DoT) encrypts your DNS lookups by wrapping them in TLS, so no one on the network path can see or alter which domains you resolve. It does the same job as DNS over HTTPS but on a dedicated port (853) rather than blending into web traffic. That makes DoT easy for a network administrator to identify and manage — a plus for enterprise policy, a minus if you want the queries to be indistinguishable from ordinary HTTPS, where DoH has the edge.

Like DoH, DoT protects the lookup itself but does not hide your IP or tunnel the rest of your traffic — it is one layer, not a whole privacy stack. If you run a VPN, the key protection against a DNS leak is routing DNS through the tunnel; encrypted DNS then adds confidentiality on top. The choice between DoT and DoH is largely about the port and how visible the traffic is on the network. Whichever you pick, remember the resolver still sees your queries, so trusting the operator you send them to remains part of the decision.

Whichever encrypted-DNS variant you pick, the resolver still sees your queries, so the operator you trust matters. On a VPN, route DNS through the tunnel first to prevent a leak, then use DoT or DoH for confidentiality on top. Choose DoT when a network needs to manage the traffic on its dedicated port, and DoH when you want the queries to blend into ordinary HTTPS and resist blocking — the security is identical either way.