DNS over TLS: What It Is & How to Enable It

DNS over TLS (DoT) encrypts your DNS queries between your device and a resolver, preventing eavesdroppers from seeing which domains you look up. You enable it by changing your DNS server settings to a DoT-capable resolver and, on many systems, turning on the DoT option. This article explains how DoT works, how it compares to DNS over HTTPS, and how to set it up on common devices.

What Is DNS and Why Does It Need Encryption?

The Domain Name System (DNS) is the phonebook of the internet – it translates human-readable names like example.com into IP addresses that computers use to connect. Traditionally, DNS queries are sent in plaintext over UDP or TCP port 53. That means anyone on your network path (your ISP, a Wi-Fi hotspot operator, or a malicious actor) can see every domain you visit. They cannot see the full URL or the content, but they can build a profile of your browsing habits.

DNS over TLS (DoT) fixes this by wrapping the DNS query in a TLS (Transport Layer Security) connection – the same encryption technology that secures HTTPS websites. The encrypted stream travels over port 853, and the resolver’s certificate is validated to prevent impersonation. This gives you confidentiality and integrity for your DNS lookups.

How DNS over TLS Works

When you enable DoT on your device, it establishes a persistent TCP connection to a DoT-enabled resolver (for example, Cloudflare’s 1.1.1.1 or Google’s 8.8.8.8). The connection is encrypted with TLS, and the resolver’s certificate is checked against a trusted root. Your DNS queries are then sent inside that encrypted session.

Key technical details:

• DoT uses a dedicated port (853) for the TLS connection.
• It typically uses TLS 1.3 or 1.2, with certificate pinning or strict validation.
• Because it uses a separate port, network firewalls can block it – some public Wi-Fi networks only allow ports 80 and 443.
• DoT is a relatively simple protocol, but it requires the client (your device) to know the resolver’s IP address and hostname.

DNS over TLS vs. DNS over HTTPS

The most common comparison is DoT vs. DNS over HTTPS (DoH). Both encrypt DNS queries, but they differ in transport:

• Port: DoT uses port 853; DoH uses port 443 (the same as HTTPS). This makes DoH harder to block because it looks like normal web traffic.
• Implementation: DoH sends DNS queries inside HTTP requests, so it can be handled by web servers and caches. DoT is a simpler, direct TLS connection.
• Visibility: DoT’s port is easily identifiable, so a network administrator can block it. DoH is often indistinguishable from other HTTPS traffic, which can be a problem for enterprise networks that want to enforce content filtering.
• Performance: Both add a small overhead compared to plain DNS. DoH may have slightly higher latency due to HTTP overhead, but in practice the difference is negligible.

For most users, either is a significant privacy upgrade over plaintext DNS. The choice often depends on your device’s support and whether you need to avoid port blocking.

How to Enable DNS over TLS on Common Systems

Enabling DoT is not always a one-click process. Here are the general steps for the most common platforms (exact menus may vary by version):

Windows 11

1. Open Settings → Network & Internet → Wi-Fi (or Ethernet).
2. Click on your active network.
3. Scroll to DNS server assignment and click Edit.
4. Set the dropdown to Manual and toggle IPv4 on.
5. Enter a DoT resolver’s IP (e.g., 1.1.1.1) and set the “Preferred DNS encryption” to Encrypted only (DNS over TLS).
6. Enter the resolver’s hostname (e.g., cloudflare-dns.com).
7. Save and reconnect.

Android

1. Open Settings → Network & Internet → Private DNS.
2. Select Private DNS provider hostname.
3. Enter a DoT hostname (e.g., dns.google or one.one.one.one).
4. Tap Save.

Note: Android’s “Private DNS” feature actually uses DoT by default, but it may fall back to DoH if DoT is not available.

iOS / macOS

Apple does not expose a system-wide DoT toggle. You need to install a configuration profile (a .mobileconfig file) from a trusted provider, or use a third-party app that supports DoT. The profile must include the resolver’s IP, hostname, and certificate.

Linux

Most Linux distributions use systemd-resolved. You can enable DoT by editing /etc/systemd/resolved.conf and setting:

DNS=1.1.1.1
DNSOverTLS=yes

Then restart the service with sudo systemctl restart systemd-resolved.

Common Problems and How to Troubleshoot

DoT can fail for several reasons. Here are the most common issues and what to do:

• Blocked port 853: Some networks (hotels, airports, corporate) block non-standard ports. Try using DoH instead, or switch back to plain DNS on that network.
• Certificate errors: If the resolver’s certificate is not trusted, your device will refuse to connect. Make sure you entered the correct hostname and that your system’s date is accurate.
• No internet after enabling: This usually means the DoT resolver is unreachable. Double-check the IP and hostname, and temporarily disable DoT to confirm.
• Slow browsing: DoT adds a small overhead. If you notice significant slowdowns, try a different resolver or check your network connection.
• Parental controls or filtering stop working: Some routers or services rely on plain DNS to enforce filters. DoT bypasses them, so you may need to configure filtering at the resolver level.

Does DNS over TLS Affect Performance?

DoT adds a tiny amount of latency because of the TLS handshake, but once the connection is established, queries are sent over a persistent connection, so the overhead is minimal. In practice, the difference is usually less than 1–2 milliseconds per query. The larger factor is the resolver’s own speed and your network latency.

Frequently Asked Questions

Is DNS over TLS the same as a VPN?

No. A VPN encrypts all your internet traffic and routes it through a server, hiding your IP address and all activity. DoT only encrypts your DNS queries – it does not hide your IP address or encrypt the actual websites you visit. For full privacy, you would need a VPN or Tor.

Can I use DNS over TLS with any DNS resolver?

No. The resolver must support DoT (listen on port 853 with a valid certificate). Most major public resolvers (Cloudflare, Google, Quad9) support DoT, but your ISP’s resolver may not.

Will DNS over TLS stop my ISP from seeing my browsing history?

It stops your ISP from seeing the domain names you look up, but they can still see the IP addresses you connect to and the amount of traffic. They can often infer the websites you visit from the IP addresses, though not always. DoT is a privacy improvement, not a complete anonymity tool.

Why does my router not support DNS over TLS?

Many older routers only support plain DNS forwarding. You can still enable DoT on individual devices (like your phone or PC) by changing their DNS settings. Alternatively, you can install custom firmware on your router if it is compatible, but that is more advanced.

Is DNS over TLS faster than plain DNS?

Usually not – it is slightly slower due to the TLS handshake. However, if your ISP’s DNS is slow, switching to a faster DoT resolver can improve performance. The encryption overhead is negligible compared to the benefits of a responsive resolver.

Can I use DNS over TLS on a public Wi-Fi network?

Yes, but only if the network allows outbound traffic on port 853. Many public Wi-Fi portals block non-standard ports, so DoT may fail. In that case, try DoH (port 443) or use plain DNS while on that network.

Related

• Audi e-tron Battery Charging Technology Explained
• Amazon Rufus AI Chat vs Perplexity: Which Is Better?
• Tiny Local LLM Setup: Can Your Device Handle It?