DNS over HTTPS (DoH) and DNS over TLS (DoT) Explained

Traditional DNS sends queries in plain text over UDP port 53, so anyone on the network path can see – and potentially tamper with – which sites you look up. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt the connection between a client and its resolver. This guide explains both and how to use them on a server.

Before you start

Encrypted DNS protects the link to a resolver. It does not change how your domain's authoritative DNS works, so you do not need to change anything on your hosting to support visitors using DoH.

DoH vs DoT vs DNSSEC

	DNS over TLS (DoT)	DNS over HTTPS (DoH)	DNSSEC
Protects	Privacy and integrity of the client–resolver link	Privacy and integrity of the client–resolver link	Authenticity of DNS data end to end
Transport	TLS on port 853	HTTPS on port 443	Normal DNS with signatures
Easy to block or identify	Yes (dedicated port)	Hard (looks like web traffic)	N/A
Typical users	Operating systems, Android "Private DNS", servers	Browsers, apps	Resolvers validating zones

They complement each other: DoH/DoT hide queries in transit; DNSSEC proves answers are genuine.

Where it's used

Browsers – Firefox, Chrome, Edge and Safari can use DoH, often automatically when the system resolver supports it.
Android – "Private DNS" setting uses DoT.
Windows 11 and macOS/iOS – support encrypted DNS at the OS level.
Public resolvers – Cloudflare (1.1.1.1), Google (8.8.8.8) and Quad9 (9.9.9.9) offer both.

Use DoT on a Linux server with systemd-resolved

Edit /etc/systemd/resolved.conf:

[Resolve]
DNS=9.9.9.9#dns.quad9.net 1.1.1.1#cloudflare-dns.com
DNSOverTLS=yes

Restart: sudo systemctl restart systemd-resolved.
Check: resolvectl status should show +DNSOverTLS.

The #hostname part lets resolved verify the resolver's certificate.

Use DoT forwarding with Unbound

server:
    tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 9.9.9.9@853#dns.quad9.net
    forward-addr: 1.1.1.1@853#cloudflare-dns.com

On AlmaLinux/Rocky the bundle is /etc/pki/tls/certs/ca-bundle.crt.

Trade-offs

Trust shifts to the resolver – it still sees all your queries.
Network policies – DoH in browsers can bypass company DNS filtering; organisations may manage it with policies.
Mail servers – DNS blocklists often refuse queries from big public resolvers; a local recursive resolver (Unbound without forwarding) can be better for mail servers.
Slight latency – TLS setup adds a little time, mostly hidden by connection reuse and caching.

FAQ: DoH and DoT

Does DoH hide which websites I visit?

It hides DNS queries from the network, but the destination IP and often the SNI in TLS are still visible unless Encrypted Client Hello is used.

Do I need to enable anything on my web hosting?

No. Visitors' DoH use doesn't affect your hosting.

Is DoT or DoH better?

Technically similar. DoT is easier for administrators to manage; DoH is harder to block.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket