Encrypting DNS: DoH, DoT, and DoQ

Filed under Notes on July 17, 2026 · updated

Plain DNS is cleartext on port 53. How DoT, DoH, and DoQ encrypt it, how DoH rides HTTPS, and exactly what your ISP can still see. Part 3 of a DNS series.

Classic DNS (Do53) is cleartext on port 53: your ISP reads, and can rewrite, every name you look up. Three encrypted transports fix that, to different degrees. For the lookup this protects, start with how DNS works.

Switch between them to see what still leaks:

you resolver
Q: hugosibony.com A · A: 104.21.86.12

port UDP / TCP · 53 RFC 1035

Encapsulation

  • DNS message question + answer, plaintext
  • UDP :53 no encryption layer at all

= encrypted, unreadable on the wire

What your ISP still sees

Everything. The exact name you asked for and the IP you got back, in cleartext. Your ISP can log it, sell it, or rewrite the answer.

encrypted TLS record

port TCP · 853 RFC 7858

Encapsulation

  • DNS message the query bytes
  • TLS encrypts everything above
  • TCP :853 dedicated DNS-over-TLS port

= encrypted, unreadable on the wire

What your ISP still sees

That you sent DNS to this resolver, and nothing about the names. Port 853 is a dead giveaway that it is DNS, so it can be blocked wholesale.

encrypted QUIC packet

port UDP · 853 RFC 9250

Encapsulation

  • DNS message the query bytes
  • QUIC (TLS 1.3) encrypts everything above
  • UDP :853 QUIC transport, not TCP

= encrypted, unreadable on the wire

What your ISP still sees

Same as DoT: which resolver you chose, and that it is DNS (the UDP/853 signature). Query names stay hidden. Lower latency than DoT.

encrypted HTTPS request

port TCP · 443 RFC 8484

Encapsulation

  • DNS message POST /dns-query · application/dns-message
  • HTTP/2 wraps the message as an HTTPS request
  • TLS encrypts everything above
  • TCP :443 same port as all HTTPS

= encrypted, unreadable on the wire

What your ISP still sees

Only that you opened an HTTPS connection to this IP, indistinguishable from loading any website. Hardest to block or profile.

In every encrypted mode the observer still learns the resolver's IP, and the TLS SNI can leak which resolver you picked, unless Encrypted Client Hello (ECH) hides it. Your individual queries stay private either way.

The catch in every encrypted mode: the observer still sees the resolver’s IP, and the TLS SNI can reveal which resolver you picked unless Encrypted Client Hello (ECH) hides it. Your individual queries stay private either way.

To turn encryption on and prove it works, see which resolver to choose.

References

  • RFC 7858: DNS over TLS (DoT), TCP 853.
  • RFC 8484: DNS over HTTPS (DoH), application/dns-message over TCP 443.
  • RFC 9250: DNS over QUIC (DoQ), UDP 853.
  • RFC 1035: classic DNS (Do53) over UDP/TCP 53.
  • RFC 9460: the HTTPS record and its Encrypted Client Hello (ECH) hint.

DNS series

  1. How DNS works
  2. Inside a DNS packet
  3. Encrypting DNS (this post)
  4. How malware abuses DNS

Practical companion: Which resolver to choose.

Last updated on
-- views