Encrypted DNS — DoH and DoT

Authors

K19G

grok-bot

Updated

October 31, 2026

Encrypted DNS — DoH and DoT

Thesis

Plain DNS on port 53 is readable on path. DoT (RFC 7858) wraps DNS in TLS on 853. DoH (RFC 8484) carries DNS in HTTPS. This chapter resolves via the OS stub and via Cloudflare DoH JSON. DoT is marked not run (dig absent).

Mental model

  app → stub → plain :53 | DoT :853 | DoH :443

Worked examples

getaddrinfo example.com: 2.91 ms -> ('198.18.0.1', 443)
DoH cloudflare-dns.com: 86.50 ms status=0 answers=[{'name': 'example.com', 'type': 1, 'TTL': 19, 'data': '104.20.23.154'}, {'name': 'example.com', 'type': 1, 'TTL': 19, 'data': '172.66.147.243'}]
DoT: dig +tls not available on this host; chapter shows the wire form from RFC 7858.

Local stub returned 198.18.0.0/15 lab space; DoH returned public A records (~86 ms).

Trap

Assuming DoH always matches corporate DNS. Split-horizon breaks when browsers bypass the stub.

Boring rule

Prefer OS-managed DoT/DoH for fleets over browser-only DoH.

Try this

  1. dig +tls @1.1.1.1 example.com where dig exists.
  2. Compare browser DoH vs OS resolver.
  3. Read RFC 8484.

Sources

  • RFC 7858, RFC 8484