DNS over HTTPS and DNS over TLS: How They Work and Their Differences

The hidden vulnerability of traditional internet

When we type an address into our browser, the computer must translate that readable name into a numerical IP address, much like looking up a contact in a phone book. Historically, this lookup happens via the DNS (Domain Name System) protocol, a foundational system conceived in the 1980s without any privacy considerations whatsoever. In practice, this means every website query you make travels across the network completely in the open, in plain text. Any intermediary along the path, such as your internet service provider, a public Wi-Fi network, or a malicious attacker, can read exactly which pages you are accessing. This exposure has enabled decades of passive surveillance, targeted censorship, and malicious ad injection directly into network routes.

The rise of domain name encryption

To stem this data bleeding, the network engineering community developed two primary solutions: DoT (DNS over TLS) and DoH (DNS over HTTPS). Both share the noble goal of shielding your queries from prying eyes using end-to-end encryption. TLS (Transport Layer Security), the same technology behind the green padlock and HTTPS on secure websites, serves as the foundation for both methods. In practice, they turn the conversation between your device and the name server into a digital vault that nobody in the middle can crack open. However, despite sharing the same cryptographic root, the way they package and deliver this data across the network is radically different.

How DNS over TLS (DoT) works

DoT was the first to gain a formal specification in RFC 7858 and operates in a quite direct, isolated manner. It takes traditional DNS messages and wraps them directly in a TLS security layer, establishing a dedicated connection. In practice, all this data exchange happens on a unique network port reserved by internet standards authorities, port 853. This means DoT traffic carries its own unmistakable identity on the network. When a router or corporate firewall observes packets flowing through port 853, it instantly knows it is dealing with an encrypted name query. This predictability makes life much easier for network administrators who need to audit, monitor, or block name traffic in corporate or school environments.

How DNS over HTTPS (DoH) works

DoH, standardized in RFC 8484, adopts a much more subtle and clever camouflage strategy. Instead of carving out a dedicated channel on an exclusive port, DoH wraps DNS queries into ordinary HTTP or HTTP/2 requests, identical to the ones your browser makes when downloading images, text, and scripts from a web page. In practice, this means DoH traffic travels over the exact same port 443 used by any secure website on the internet. To an external observer, including your internet service provider or a restrictive firewall, DoH is completely indistinguishable from normal web browsing. This camouflage makes it extremely difficult for authoritarian governments or corporate networks to block alternative DNS servers without ending up breaking access to a vast portion of the legitimate web.

The technical battle: DoH versus DoT

Choosing between DoH and DoT involves more than just aesthetic engineering preferences; it entails deep operational trade-offs. DoT offers strict control and diagnostic simplicity, allowing corporate firewalls to enforce traditional security policies based on specific network ports. On the other hand, DoH wins hands down in scenarios where network neutrality is under threat, as its HTTPS camouflage prevents selective censorship based on deep packet inspection. Furthermore, modern web browsers like Firefox and Google Chrome implement DoH natively in their code, allowing the application to bypass operating system network settings and offer immediate protection to everyday users, regardless of the Wi-Fi network they connect to.

The impact on performance and network latency

A common fear among developers and system administrators is the performance hit that extra encryption might impose on page load speeds. In practice, both DoH and DoT add an initial computational overhead to establish the TLS cryptographic handshake before the first real DNS query can be processed. However, because both protocols support persistent connections and advanced multiplexing via HTTP/2 and modern TLS, this extra latency occurs only on the first connection. Subsequent queries reuse the opened secure channel, resulting in response times practically identical to traditional DNS, with the massive advantage of eliminating intermediary spoofing attacks.

The centralization of trust and new operational challenges

Despite solving local snooping privacy issues, DoH and DoT introduce a complex new geopolitical and architectural dilemma: traffic centralization. Because most operating systems and browsers default to massive servers like Cloudflare, Google, or Quad9, billions of name requests worldwide become concentrated in the hands of a few multinational corporations. In practice, this creates single points of systemic failure and concentrates highly valuable behavioral data into centralized portals. Corporate network administrators also lose visibility into internal threats that use covert DoH channels to leak company data or bypass internal compliance policies.

Conclusion and recommendations for future infrastructure

The evolution of name resolution protocols represents a historic milestone in the transition toward an inherently more secure internet resistant to mass surveillance. DoT shines in controlled environments where edge control and network governance are absolute priorities for information security teams. Meanwhile, DoH establishes the gold standard for end-user privacy, hindering arbitrary censorship and ensuring the right to confidential browsing is preserved on hostile public networks. Understanding these nuances empowers engineers, developers, and administrators to make conscious architectural decisions, balancing legitimate corporate governance demands with the unalienable right to digital privacy.