DNS Encryption Protocols Aren’t Equal: What ISPs Hide

DNS encryption protocols are not equal, and your ISP hopes you don’t know that some of them still expose your browsing history. While DoH (DNS over HTTPS) and DoT (DNS over TLS) both encrypt your queries, they differ in how they handle privacy, performance, and compatibility, and one of them is significantly easier for your ISP to block or bypass. This article explains the real differences so you can choose the right one for your needs.

Why DNS Encryption Matters

Every time you visit a website, your device asks a DNS resolver to translate the domain name (like example.com) into an IP address. Without encryption, that query is sent in plain text, so anyone on the network—including your ISP—can see which domains you look up. That data reveals your browsing history, even if the websites themselves use HTTPS. DNS encryption hides those queries from eavesdroppers, but not all protocols do it the same way.

DoH vs. DoT: The Core Difference

DNS over HTTPS (DoH) sends queries inside the standard HTTPS port 443, the same port used for secure web traffic. DNS over TLS (DoT) uses a dedicated port 853. That seemingly small difference has big implications:

• Port 443 blending: DoH traffic looks like regular website traffic, so it is harder for a network to identify and block it. DoT is on a dedicated port, so a firewall can easily block it.
• Performance: DoH can be slightly slower because it adds an extra HTTP layer, but it benefits from HTTP/2 multiplexing. DoT has lower overhead but is easier to throttle.
• Default behavior: Major browsers (Chrome, Firefox, Edge) have adopted DoH, while DoT is more common in operating system–level resolvers (like Android’s Private DNS).

What Your ISP Can Still See

Even with DoH or DoT, your ISP can still see the IP address of the resolver you use and the timing and size of your queries. That means they can infer that you are using a particular DNS service, but they cannot see the specific domain names. However, if you use a DoH resolver that your ISP has not explicitly blocked, the ISP may not even know you are using DNS encryption at all because the traffic is mixed with other HTTPS traffic. DoT, by contrast, is easily identified and can be blocked by ISPs that want to force you to use their own resolver.

How to Choose a Protocol

Your choice depends on your threat model and your network environment:

• If you want to avoid ISP blocking: Choose DoH, because it is harder to block than DoT.
• If you want lower latency and are on a network that allows port 853: DoT is simpler and slightly faster.
• If you are using a browser: DoH is built in, so you get it automatically when you enable it.
• If you are configuring a router or a device: DoT is often easier to configure manually, but DoH is increasingly supported.

Common Misconceptions

One common misconception is that DNS encryption gives you anonymity. It does not—it only prevents your ISP from seeing the exact domain names. The resolver you use (like Google or Cloudflare) sees everything, so you are still trusting a third party. Another misconception is that DoH is always better than DoT. In practice, DoH’s port 443 can be slower in some cases, and DoT’s dedicated port can be more reliable if the network does not block it. Also, DNS encryption does not hide your IP address from the websites you visit—that requires a VPN.

Frequently Asked Questions

Does DNS encryption slow down my internet?

Generally, the impact is negligible (a few milliseconds per query). DoH can be slightly slower than DoT due to the extra HTTP layer, but modern implementations use connection reuse, so the difference is often unnoticeable. If you experience a slowdown, it is more likely due to your resolver’s location or your network conditions.

Can my ISP still see my browsing history if I use DoH?

No, your ISP cannot see the domain names you look up if you use DoH, because the queries are encrypted. However, they can see that you are connecting to a specific DoH resolver, and they can see the timing and size of the queries, which could leak some information. They also see the IP addresses of the websites you eventually visit, but not the domain names.

Is DoH or DoT more secure?

Both are equally secure in terms of encryption strength (they use TLS). The difference is in privacy against network eavesdroppers: DoH’s port 443 makes it harder to block, while DoT’s dedicated port makes it easier to identify and block. Security-wise, both protect your queries from being read or modified in transit.

Should I use a VPN instead of DNS encryption?

VPNs encrypt all your traffic, not just DNS queries, and hide your IP address from websites. DNS encryption only protects your DNS lookups. If you want to hide your browsing activity from your ISP entirely, a VPN is more comprehensive, but it can be slower and more expensive. Many people use both: a VPN for general privacy and DoH for an extra layer of DNS protection.

Why would an ISP block DoT but not DoH?

Because DoT uses a dedicated port (853) that is easy to identify and block with a firewall. DoH uses port 443, which is the same port used by all HTTPS traffic, so blocking it would break the entire web. That is why some ISPs that want to enforce their own DNS policies block DoT but leave DoH alone—or try to redirect DoH traffic using other methods.

Do I need to configure DoH on every device?

Yes, if you want to protect all your devices. Browsers have their own DoH settings, but other apps and the operating system may still use plain DNS. You can configure DoH at the router level, but not all routers support it. Alternatively, you can set up a local DNS server that forwards queries using DoH, which is a more advanced solution.

Related

• Ready or Not Crashing? Fixes That Work
• i9 11900K vs Ryzen 9 5950X: Which CPU Wins?
• Games vs Live Animal Displays: What Engages Zoo Visitors?