Cybersecurity glossary
What is DNS over TLS (DoT)?
Learn what DNS over TLS (DoT) is, how DNS queries are encrypted on a dedicated TLS channel, how it differs from DoH and DoQ, and how to deploy it safely.
Definition
DNS over TLS (DoT) is a protocol that encrypts DNS queries and responses between a client and a resolver using TLS, typically on port 853, protecting the resolution path from eavesdropping and on-path tampering.
Why DoT matters
Cleartext DNS exposes browsing and service discovery patterns to every hop between a device and its resolver. DNS over TLS (DoT) adds a dedicated encrypted channel so queries and answers are confidential and integrity-protected on that path.
Unlike DoH, DoT does not pretend to be web traffic. That clarity helps network operators manage it—and helps attackers notice it too.
How DoT works
Configure a DoT resolver
The stub resolver or OS is pointed at a hostname/IP that offers DNS over TLS.
Connect to port 853
The client opens TCP to the resolver’s DoT listener and starts a TLS handshake.
Authenticate the server
Certificate validation (and optional pinning profiles) confirm the intended resolver.
Exchange DNS messages
Standard DNS payloads travel inside the encrypted TLS session.
Resolver performs lookup
The service recurses or answers from cache, then returns encrypted results.
Maintain or reopen sessions
Clients may keep TLS sessions warm to reduce handshake overhead on later queries.
Strengths relative to other options
Clear security boundary
A dedicated port and protocol make policy and monitoring straightforward.
Strong path protection
TLS hides QNAMEs from on-path observers and blocks trivial injection.
Enterprise fit
Internal DoT endpoints preserve recursive logging and filtering controls.
Easier to restrict
Networks can allow only approved DoT resolvers more easily than DoH on 443.
DoT vs DoH at a glance
| Aspect | DoT | DoH |
|---|---|---|
| Default port | TCP 853 | TCP/UDP 443 |
| Appearance on network | Identifiable encrypted DNS | Similar to ordinary HTTPS |
| Policy control | Easier to allowlist/block | Harder to distinguish from web |
| Consumer adoption | Strong on some OS resolvers | Common in browsers and apps |
Deployment checklist
- Publish DoT service on trusted certificates that match the resolver identity clients expect.
- Prefer strict authentication profiles so opportunistic modes cannot be downgraded silently.
- For enterprises, offer an internal DoT resolver aligned with security DNS policy.
- Monitor TCP/853 availability separately from classic UDP/53 health checks.
- Combine DoT with DNSSEC validation for data authenticity beyond transport security.
- Document fallback behavior when DoT is unreachable.
- Rate-limit and abuse-protect public DoT listeners like any recursive service.
- Review whether unmanaged external DoT conflicts with compliance logging requirements.
The practical takeaway
DNS over TLS (DoT) encrypts stub-to-resolver DNS on a dedicated TLS channel, usually port 853. It improves privacy and on-path integrity without hiding DNS inside web protocols.
Use DoT when you want encrypted resolution that networks can govern explicitly—and remember that the resolver you choose still sees every name you ask.
Related security terms
DNS over HTTPS (DoH)
Encrypts DNS inside HTTPS, often blending with web traffic on port 443.
DNS over QUIC (DoQ)
Encrypts DNS using QUIC, commonly on UDP/853.
SSL/TLS
The cryptographic protocols DoT uses to secure the DNS channel.
Recursive DNS Resolver
Common DoT server role that answers encrypted client queries.
DNSSEC (Domain Name System Security Extensions)
Validates DNS data authenticity; complements DoT’s transport encryption.
Frequently asked questions
What is DoT in simple terms?
DoT puts a TLS lock on the conversation between your device and its DNS resolver so nearby networks cannot easily read or alter your DNS lookups.
Which port does DoT use?
The standard port is TCP 853. Some deployments may use other ports, but 853 is the well-known default.
Is DoT better than DoH?
Neither is universally better. DoT is easier for networks to identify and manage; DoH can be harder to block because it uses HTTPS. Choose based on privacy goals and operational control.
Does DoT hide queries from my ISP resolver?
Only if you send DoT to a different resolver. If your ISP operates the DoT endpoint, it still sees the names you resolve.
Can enterprises force DoT to an internal resolver?
Yes. Many organizations deploy internal DoT endpoints and discourage or block unmanaged external encrypted DNS.
Does DoT authenticate DNS records?
DoT authenticates the channel to the resolver. DNSSEC authenticates the DNS data itself. Use both for stronger assurance.
What happens if port 853 is blocked?
DoT fails unless the client falls back to another method such as DoH, DoQ, or classic DNS—depending on configuration.
References
Explore authoritative guidance and frameworks related to dns over tls (dot).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.