What is DNS over TLS (DoT)?
Last updated: April 21, 2026
Definition
DNS over TLS (DoT) is a network security protocol that encrypts Domain Name System queries and responses within Transport Layer Security connections over port 853. IT teams use DoT to prevent DNS surveillance by ISPs while maintaining visibility through dedicated port-based management.
Key Facts
- Also known as: DoT
- Category: Network Security / Cybersecurity
- Related standards: RFC 7858 (May 2016), RFC 8310
- Key implementations: Quad9 (2017), Google Public DNS, Cloudflare, Android Pie (2018), iOS 14 (2020), macOS 11 (2020), DNSFilter, NextDNS
- First standardized: May 2016 (IETF RFC 7858)
How DNS over TLS Works
When a DNS client initiates a DoT query, it establishes a TCP connection to a DoT-enabled resolver on port 853. The client and resolver perform a TLS handshake, verifying the resolver's certificate to authenticate the server. Once the TLS session is established, DNS queries and responses travel over the encrypted channel, protecting them from eavesdropping and manipulation.
The protocol operates identically to standard DNS at the application layer. Query types, response formats, and DNS features like DNSSEC remain unchanged. DoT supports two operational modes: strict privacy (certificate validation required, connection fails if TLS can't be established) and opportunistic privacy (attempts DoT but falls back to unencrypted DNS if secure connection fails).
Unlike DNS over HTTPS, which uses port 443 and blends with web traffic, DoT's dedicated port 853 makes encrypted DNS queries visible to network administrators. This visibility allows enterprises to enforce DNS policies and route traffic through managed resolvers while encrypting queries between clients and approved resolvers. Organizations with managed security operations can monitor DoT traffic patterns for anomaly detection without decrypting individual queries.
Why DNS over TLS Matters
Without encrypted DNS, every domain lookup transmits in plaintext over port 53, allowing ISPs and network observers to see which websites users visit. DoT encrypts the DNS query layer while maintaining network visibility for IT teams.
The DNS over TLS security market reached $1.28 billion in 2024 and is projected to grow at 18.6% annually through 2033 (DataIntelo, 2024). For enterprise networks, DoT's port 853 allows administrators to enforce security policies through managed resolvers while blocking unauthorized external DNS services. Teams managing network infrastructure management configure DoT at the resolver level, preserving DNS monitoring capabilities.
Government agencies and managed service providers prefer DoT for organizational deployments because of this visibility advantage. Android, iOS, and macOS added DoT support between 2018 and 2020.
DNS over TLS vs. DNS over HTTPS
| Aspect | DNS over TLS (DoT) | DNS over HTTPS (DoH) |
| Port | Dedicated port 853 | Standard HTTPS port 443 |
| Network visibility | Easily identifiable, manageable | Blends with web traffic |
| Enterprise use | Preferred for managed networks | Bypasses network DNS controls |
| Key difference | Enables DNS policy enforcement | Prioritizes individual privacy |
| Best for | IT teams managing DNS security | Privacy-focused individual users |
DoT uses port 853 for visibility and control, while DoH uses port 443 to blend DNS with HTTPS traffic.
Common Misconceptions
DNS over TLS is not end-to-end encryption to authoritative nameservers. DoT encrypts only the client-to-resolver connection, while queries from resolver to authoritative servers typically use unencrypted DNS.
DoT does not hide which websites users visit from network observers. While DoT encrypts DNS queries, Server Name Indication (SNI) in TLS handshakes and destination IP addresses remain visible, allowing ISPs to infer browsing activity.
Frequently Asked Questions
DoT uses port 853, allowing administrators to identify and manage encrypted DNS while enforcing policies. DoH uses port 443, blending DNS with web traffic to bypass controls. Enterprises deploy DoT for managed environments; DoH suits individual privacy.
DoT encrypts DNS queries but doesn't hide Server Name Indication (SNI) in TLS handshakes or destination IPs. Observers correlate encrypted DNS with HTTPS connections to infer browsing. Complete privacy requires encrypted SNI or VPN tunneling.
Blocking external DoT forces endpoints through managed DNS where security policies apply—threat feeds, content filtering, Response Policy Zones. This preserves DNS-layer controls while allowing internal DoT encryption. Organizations deploying enterprise cybersecurity services configure firewalls to permit DoT only to approved internal resolvers, maintaining both privacy and policy enforcement.
