DoT
also: DNS over TLS
DNS over TLS (DoT) is a protocol that encrypts DNS queries and responses using TLS encryption, preventing eavesdropping on domain name lookups.
DNS over TLS wraps standard DNS traffic in a TLS (Transport Layer Security) connection, the same encryption used for HTTPS websites. This protects your DNS queries from being intercepted or monitored by ISPs, network administrators, or attackers on shared networks.
Normally, DNS requests travel unencrypted over UDP port 53, making them visible to anyone observing network traffic. DoT uses TCP port 853 and encrypts the entire conversation, so only you and your DNS resolver know which domains you're visiting.
Example: Instead of your system sending a plaintext query asking "What is the IP for google.com?", DoT encrypts that request before sending it to a DoT-capable resolver like 8.8.8.8:853 (Google's public DNS over TLS).