Glossary · DNS

DoT (DNS over TLS)

DNS over TLS (DoT) encrypts DNS queries between a client and a resolver using a dedicated TLS connection on port 853, defined in RFC 7858.

Updated October 6, 2026

DNS over TLS (DoT, RFC 7858) carries ordinary DNS messages inside a TLS session, by convention on TCP port 853. It gives the same confidentiality and tamper protection against on-path attackers that HTTPS gives web traffic, but without the HTTP layer.

Why it matters

Because DoT uses its own port, network administrators can easily see, allow or block it, which is a key difference from DNS over HTTPS, where DNS hides among normal web traffic. Android's "Private DNS" feature uses DoT, and many resolvers and forwarders such as Unbound support it. Like DoH, it protects the link to your resolver only. It does not authenticate the records themselves.

Example

Test a DoT resolver with kdig from the Knot tools:

kdig -d @1.1.1.1 +tls-host=cloudflare-dns.com +tls example.com A

An Unbound forwarder setting looks like:

forward-zone:
  name: "."
  forward-tls-upstream: yes
  forward-addr: 1.1.1.1@853#cloudflare-dns.com

Common mistakes

  • Blocking outbound port 853 in a firewall and then wondering why Private DNS fails on phones.
  • Skipping certificate name validation, which leaves the connection open to impersonation.
  • Confusing it with DNSSEC, which signs the data.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecurityEncrypted Client Hello (ECH)Encrypted Client Hello is a TLS extension that encrypts the first handshake message, hiding the requested hostname (SNI) from network observers.Guide · EmailMTA-STS and TLS-RPT Guide: Enforce TLS for Inbound EmailHow to set up MTA-STS and TLS-RPT: the DNS TXT records, the policy file on mta-sts.example.com, testing, enforce mode, and how to read TLS reports.6 min readGuide · PerformanceWhy Is My Website Slow? A Step-by-Step Diagnosis FlowchartWork through DNS, connect, TLS, TTFB, download and render in order to find which stage makes your site slow, with the right tool and command for each.8 min readError fix · Browser errorsFirefox Secure Connection Failed: Error Codes and FixesFirefox's Secure Connection Failed page names a specific error code. Match SSL_ERROR, PR_ and SEC_ERROR codes to their causes and fix them.4 min readError fix · Browser errorsSafari Can't Open the Page: Server Unexpectedly Dropped the ConnectionSafari says the server unexpectedly dropped the connection when a TLS or TCP session is cut. Try Private Relay, DNS and content blockers, then fix the server.4 min readGlossary · DNSA Record (Address Record)An A record maps a hostname to an IPv4 address and is the most common DNS record for pointing a domain at a web server.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.