DNS over TLS
also: DoT
DNS over TLS (DoT) is a protocol that encrypts DNS queries and responses using TLS encryption, preventing eavesdropping on DNS traffic and protecting user privacy.
DNS over TLS wraps standard DNS communication in a TLS (Transport Layer Security) tunnel, similar to how HTTPS encrypts HTTP traffic. Instead of sending DNS queries in plain text over UDP port 53, DoT establishes an encrypted connection on port 853, making it impossible for networks or ISPs to see which domains a user is querying.
For example, when you enable DoT on your system or resolver (like Cloudflare's 1.1.1.1 or Quad9), your DNS client negotiates a TLS handshake before any DNS questions are sent. The query for example.com travels encrypted through the tunnel rather than in cleartext.
DoT differs from DNS over HTTPS (DoH), which uses HTTPS instead of TLS directly. Both improve privacy, but DoT is lighter-weight and more straightforward for dedicated DNS clients. You can configure DoT on Linux systems using systemd-resolved or third-party DNS clients like stubby.