Glossary · 3 min read

What Is Secure DNS (DoH and DoT)?

Learn about secure DNS protocols including DNS over HTTPS, DNS over TLS, and DNSSEC. Understand why standard DNS is insecure and how to protect your queries.

What Is Secure DNS (DoH and DoT)?

Secure DNS refers to protocols and mechanisms that protect DNS queries from eavesdropping, tampering, and spoofing. Standard DNS transmits queries in plaintext over UDP port 53, making it trivial for anyone on the network path to see which domains you are resolving or to inject forged responses. Secure DNS addresses these vulnerabilities through encryption and authentication.

Why Standard DNS Is Insecure

Traditional DNS (RFC 1035) has no built-in encryption or authentication. This creates several risks:

  • Eavesdropping. ISPs, Wi-Fi operators, and on-path attackers can see every domain you query.
  • DNS spoofing/poisoning. An attacker can inject forged responses, redirecting you to malicious servers. This is the attack that DNSSEC was designed to prevent.
  • Censorship and manipulation. Network operators can modify DNS responses to block or redirect domains.

DNS over HTTPS (DoH)

DoH (RFC 8484) sends DNS queries inside encrypted HTTPS connections on port 443. Because it uses the same port and protocol as regular web traffic, DoH queries blend in with normal browsing.

Browser and OS support: - Firefox enables DoH by default in the U.S. (using Cloudflare). - Chrome, Edge, and Safari support DoH when the system DNS provider offers it. - Windows 11, iOS 14+, and macOS 11+ support system-level DoH configuration.

Trade-off: DoH is excellent for individual privacy but makes it harder for network administrators to monitor or filter DNS traffic, since it is indistinguishable from HTTPS.

DNS over TLS (DoT)

DoT (RFC 7858) wraps DNS queries in TLS on a dedicated port, 853. It provides the same encryption as DoH but on a separate, identifiable port.

Support: - Android 9+ includes native DoT support under Settings > Network > Private DNS. - systemd-resolved on Linux supports DoT. - Many enterprise DNS appliances support DoT for upstream forwarding.

Trade-off: Because port 853 is distinct, network administrators can allow or block DoT traffic with standard firewall rules, making it more enterprise-friendly than DoH.

DNSSEC

DNSSEC (DNS Security Extensions, RFC 4033-4035) is fundamentally different from DoH and DoT. Instead of encrypting queries, DNSSEC authenticates responses using cryptographic signatures.

  • Zone operators sign their DNS records with a private key.
  • Resolvers verify signatures using the corresponding public key, published as DNSKEY records.
  • A chain of trust extends from the root zone down through TLD zones to individual domains.
  • DNSSEC prevents spoofing and cache poisoning but does not encrypt queries. Your ISP can still see which domains you resolve.

DNSSEC and DoH/DoT are complementary: DNSSEC ensures the answer is authentic, while DoH/DoT ensures the query is private.

Choosing a Secure DNS Resolver

Several public resolvers support all three secure DNS mechanisms:

Provider DoH DoT DNSSEC Validation
Cloudflare (1.1.1.1) Yes Yes Yes
Google (8.8.8.8) Yes Yes Yes
Quad9 (9.9.9.9) Yes Yes Yes

Relevance to Email Infrastructure

Secure DNS does not directly affect email delivery, but it protects the integrity of the DNS lookups that underpin email authentication. When a receiving mail server queries your domain's SPF, DKIM, or DMARC records, DNSSEC ensures those responses have not been tampered with. Verify that your domain's DNS records are correctly published with our DNS lookup tool.

Stay on top of your email infrastructure. Sign up for the InboxTooling newsletter for deliverability tips, tool updates, and best practices.

More glossary terms

DNS Ports Explained

Understand which network ports DNS uses, including port 53 for standard queries, port 443 for DNS over HTTPS, and port 853 for DNS over TLS.

DNS Record Types: A Complete Reference Guide

A technical reference for all major DNS record types including A, AAAA, MX, CNAME, TXT, NS, SOA, PTR, SRV, and CAA. Includes example values and use cases.

How Do IP Addresses Work?

Understand how IP addresses work, including IPv4 vs IPv6 formats, public vs private addresses, static vs dynamic assignment, NAT, and CIDR notation.

SMTP Ports Explained: 25, 465, 587, and 2525

Understand the four SMTP ports, when to use each one, the difference between STARTTLS and implicit TLS, and why ISPs block port 25.

What Is DKIM (DomainKeys Identified Mail)?

Learn how DKIM uses cryptographic signatures to authenticate email, including selector records, public/private key pairs, and the verification process per RFC 6376.

What Is DMARC?

Understand DMARC, how it builds on SPF and DKIM with alignment checks, policy options (none, quarantine, reject), and aggregate vs forensic reporting per RFC 7489.

What Is DNS (Domain Name System)?

Learn how the Domain Name System works, including recursive and iterative queries, root servers, caching, and TTL values. A technical overview referencing RFC 1035.

What Is a Domain Name?

Learn what a domain name is, how domains map to IP addresses via DNS, the difference between TLD types, and how subdomains, URLs, and hostnames relate.

What Is a Gateway IP Address?

Learn what a gateway IP address is, how default gateways route traffic between networks, and how to find your gateway address on any operating system.

What Is a Reverse Lookup?

Understand reverse lookups including reverse DNS (PTR records), reverse IP lookups, and reverse email lookups. Learn how each works, common use cases, and limitations.

What Is a Reverse Proxy?

Learn how reverse proxies work, the difference between forward and reverse proxies, and common use cases including load balancing, SSL termination, and caching.

What Is an Email Bounce?

Understand email bounces, the difference between hard and soft bounces, common SMTP error codes, and how bounces affect sender reputation.

What Is an Email Domain Name?

Learn what an email domain is, how the @domain.com part of email addresses works with MX records to route messages, and the difference between free and custom email domains.

What Is an SMTP Server?

Learn how SMTP servers work, the difference between MTA, MSA, and MDA, and how email is delivered hop by hop using the SMTP protocol defined in RFC 5321.

What Is an SPF Record?

Understand SPF records, how they authorize email senders, the TXT record format, and how receivers evaluate SPF results including pass, fail, and softfail.

What Is an SSL Certificate?

Learn how SSL/TLS certificates encrypt internet traffic, how the chain of trust works, the difference between DV, OV, and EV certificates, and why TLS replaced SSL.