DNS over TLS (DoT)
DNS queries encrypted with TLS on a dedicated port 853 — the predecessor of DoH.
DNS over TLS (DoT, RFC 7858, March 2016) wraps a DNS query in a TLS session and sends it to a dedicated TCP port 853. Unlike DoH, it does not blend with regular web traffic — the dedicated port makes it trivially identifiable. Cloudflare, Google, Quad9, and NextDNS all operate DoT endpoints. Because the protocol predates DoH by three years, it has slightly broader native support in operating systems.
Native DoT clients: Android 9+ (Settings → Network → Private DNS), iOS 14+ (configuration profile required), Linux systemd-resolved (DNSOverTLS=yes in /etc/systemd/resolved.conf), Windows 11 22H2+. Browsers generally do not support DoT directly — they prefer DoH because DoH traverses the same proxy as web traffic. This lack of browser support is why DoH has won the consumer market despite DoT being older.
DoH vs DoT in practice: DoH is preferred when the network blocks unknown UDP and non-443 TCP (most hotel Wi-Fi, some corporate networks) — DoH piggybacks on already-allowed port 443. DoT is preferred when you run your own resolver and want explicit, observable DNS for monitoring — the dedicated port makes auditing trivial. Use IPCombo's DNS widget to see which one your browser actually falls back to when the dedicated channel fails.