Simple definition
DNS over TLS (DoT) encrypts DNS exchanges between a client and its resolver using a TLS connection, normally on TCP port 853.
Technical definition
DoT transports DNS messages over TLS and can authenticate the resolver according to the client configuration. It does not make queries anonymous to that resolver or automatically encrypt its upstream DNS traffic.
Purpose and use
It protects DNS traffic confidentiality and integrity on the client-to-resolver connection.
Practical example
A compatible router or local resolver can forward DNS queries to a configured provider over DoT. Verify the provider, certificate validation and network reachability.
Common issues
- TCP port 853 blocked
- Resolver certificate not accepted
- Unsupported resolver or enterprise policy conflict
Related terms
Key takeaway: DoT protects the DNS transport, usually on TCP 853; trust in the resolver and DNS answer validation require separate consideration.
Abbreviation
DoT is the abbreviation used for this encrypted DNS transport.
Transport scope
The encrypted connection ends at the configured resolver.
Policy scope
Check the settings used by the client and the policy of the organization.
Resolver selection
Confirm the resolver actually used before comparing results.
Operational checks
Review connectivity and certificate failures without disabling certificate verification.
Related DNS concepts
DNSSEC validates DNS data; encrypted transport addresses a different part of the exchange.