dnsdome
Learn ยท Protocols

DNS-over-HTTPS vs DNS-over-TLS vs DNS-over-QUIC: which should you use?

DoH, DoT and DoQ explained: what each encrypts, which operating systems, browsers and routers speak which, how a token in the hostname identifies you without an IP address, and which to pick for phones, laptops and routers.

Last updated 24 September 2026

Why encrypt DNS at all

Classic DNS travels in plain text on UDP port 53. Anyone on the path, the coffee shop Wi-Fi, your ISP, a hotel network, can read every name your device looks up and can rewrite the answers. Encrypted DNS wraps the same questions and answers in TLS, so only you and the resolver see them, and the resolver's identity is verified by certificate. Three ways to do that are in common use.

The three transports

DNS-over-TLS (DoT)DNS-over-HTTPS (DoH)DNS-over-QUIC (DoQ)
StandardRFC 7858, 2016RFC 8484, 2018RFC 9250, 2022
PortTCP 853TCP 443, same as web trafficUDP 853
Looks likeObviously DNS to a network observer, but unreadableIndistinguishable from HTTPSObviously DoQ by port, unreadable
SpeedOne TLS handshake, then fast; connection kept openSlightly more overhead per query; HTTP/2 multiplexes wellFastest: no head-of-line blocking, 0-RTT reconnects
Easy to block by a networkYes, drop port 853Hard: blocking 443 breaks the webYes, drop UDP 853
Built intoAndroid 9+ (Private DNS), iOS/macOS profiles, systemd-resolved, Fritz!Box, ASUS, Unbound, AdGuard HomeWindows 11, Firefox, Chrome, Edge, Brave, iOS/macOS profiles, RouterOS 7, OpenWrt package, UniFi DNS ShieldAndroid 11+ via Private DNS on some builds, AdGuard Home, dnsdome Android app clients, few OSes natively yet
dnsdome address<token>.dns.dnsdome.comhttps://dns.dnsdome.com/dns-query/<token><token>.dns.dnsdome.com

The token: identity without an IP

Plain DNS has no room for "who is asking" beyond the source IP, which is why plain-DNS services need you to allowlist your IP and break when it changes. Encrypted transports connect by name, and a name can carry a secret. dnsdome gives every profile, and every device under it, its own token embedded in the hostname or URL. The resolver sees the token, applies that profile's rules, and logs the query under that profile or device. Your IP is irrelevant, so it works on mobile data, at a hotel, and behind a dynamic home connection.

Because the token is the key to your profile, treat it like a password. If one leaks, the panel's Generate new endpoints revokes it within a minute, per profile or per device.

Which one to pick

Two things encrypted DNS does not do

Is DoH "worse" because it hides DNS from network admins?
That is the debate. For a home network it is irrelevant. For an office that wants all DNS to go through its own filter, DoH in browsers is a bypass, which is why the router guides show how to block third-party DoT and why Chromium disables its DoH when it detects a managed environment.
Is DNSSEC the same thing?
No. DNSSEC signs the data so a resolver can verify it was not forged upstream. It does not encrypt anything and does not hide the query. dnsdome validates DNSSEC on your behalf; encrypted transports protect the last mile between you and dnsdome.

Put a dome over your network.

Free plan, no card. Create a profile, point your DNS, and watch the first blocked queries within minutes.