DNS Speed Test

What Is DNS over TLS

DNS over TLS (DoT) is a security protocol that encrypts DNS queries using Transport Layer Security. Traditional DNS sends queries as plaintext over UDP port 53, meaning anyone on your network path — your ISP, a Wi-Fi operator, or a government surveillance system — can see every domain you visit. DoT solves this by wrapping DNS queries inside a TLS-encrypted tunnel on port 853.

The protocol was standardized in RFC 7858 in 2016 and has since been adopted by all major public DNS providers. When you configure DoT on your device, your DNS resolver establishes a persistent encrypted connection. Every subsequent DNS query travels through this encrypted channel, protecting your browsing activity from observation.

DoT is distinct from DNS over HTTPS (DoH), which achieves the same encryption goal but uses standard HTTPS traffic on port 443. Both protocols prevent DNS eavesdropping, but they differ in how they integrate with network infrastructure.

How DNS over TLS Works

The DoT connection process follows these steps:

1. TLS Handshake: Your device initiates a TLS connection to the DNS resolver on port 853. The resolver presents its TLS certificate, which your device validates against its trusted certificate store. This step establishes the encrypted channel and verifies you are connecting to the legitimate resolver.

2. Encrypted Query: Once the TLS tunnel is established, your device sends DNS queries through the encrypted channel. The queries are encrypted before leaving your device and remain encrypted until they reach the resolver.

3. Recursive Resolution: The resolver decrypts the query, performs recursive DNS resolution (root servers, TLD servers, authoritative servers), and obtains the answer. This resolution happens over standard DNS on the resolver's side — the encryption is between your device and the resolver only.

4. Encrypted Response: The resolver encrypts the DNS response and sends it back through the TLS tunnel. Your device decrypts the response and passes the IP address to your browser.

The entire process typically adds 1-5 milliseconds compared to unencrypted DNS due to the TLS handshake. After the initial connection, subsequent queries reuse the established session with negligible overhead.

DoT vs DoH: Which Should You Use?

Both DoT and DoH encrypt DNS queries, but they differ in implementation and practical deployment:

Choose DoT if: You want slightly lower overhead, your network does not block port 853, and you are on Android where DoT has native support.

Choose DoH if: You need to bypass restrictive firewalls, you want DNS traffic to be indistinguishable from regular HTTPS, or you are using Chrome/Firefox system-level settings.

For most users, the practical difference is negligible. Both provide strong encryption. The best choice is whichever one your device supports natively and your network does not block.

Performance Benchmarks

We tested DoT performance across five major resolvers from multiple locations. The table shows average DNS resolution time including TLS overhead:

The TLS handshake adds approximately 1-3 milliseconds compared to unencrypted DNS. After the initial handshake, subsequent queries reuse the established TLS session with negligible overhead. For most users, the privacy benefit far outweighs the minimal latency cost.

Run your own DNS speed test to compare DoT performance from your specific location.

DNS Providers Supporting DoT

All major public DNS providers now support DNS over TLS:

• Cloudflare 1.1.1.1 — DoT hostname: 1dot1dot1dot1.cloudflare-dns.com
• Google 8.8.8.8 — DoT hostname: dns.google
• Quad9 9.9.9.9 — DoT hostname: dns.quad9.net
• NextDNS — DoT hostname: dns.nextdns.io
• AdGuard DNS — DoT hostname: dns.adguard.com
• CleanBrowsing — DoT hostname: cleanbrowsing.org
• OpenDNS — DoT supported on port 853

See our complete DNS provider comparison for detailed reviews of each provider.

How to Set Up DNS over TLS

Android (Native Support)

Android 9 and later include native DoT support. Go to Settings, Network and Internet, Advanced, Private DNS. Select "Private DNS provider hostname" and enter your resolver's DoT hostname (e.g., 1dot1dot1dot1.cloudflare-dns.com). Save the setting. All DNS queries from your device will now use DoT.

Windows (Using a DoT Client)

Windows does not have native DoT support. Use a DoT client like dnscrypt-proxy or Stubby. Install the client, configure it with your chosen resolver's DoT hostname, and set your system DNS to 127.0.0.1 (localhost) so all queries route through the encrypted client.

macOS (Using Stubby or dnscrypt-proxy)

Similar to Windows, macOS requires a third-party DoT client. Install Stubby via Homebrew, configure it with your resolver, and update your network DNS settings to point to 127.0.0.1.

Linux (systemd-resolved)

Modern Linux distributions with systemd support DoT natively. Edit /etc/systemd/resolved.conf and set DNSOverTLS=yes. Then configure your DNS servers with their DoT hostnames.

Router-Level DoT

Some routers support DoT natively (e.g., ASUS routers with firmware 384.x or later). Check your router's WAN or DNS settings for a "DNS over TLS" toggle. This protects every device on your network automatically.

See our complete DNS change guide for more detailed instructions on each platform.

Privacy and Security Benefits

DoT provides three key protections that unencrypted DNS lacks:

Confidentiality: Your DNS queries are encrypted, preventing ISPs, network operators, and surveillance systems from seeing which domains you visit. This protects your browsing privacy on public Wi-Fi, corporate networks, and any shared connection.

Integrity: TLS prevents man-in-the-middle attacks that could modify DNS responses. Without encryption, an attacker on your network could redirect you to malicious sites by altering DNS answers. DoT ensures the response you receive is exactly what the resolver sent.

Authentication: The TLS certificate verifies you are connecting to the legitimate resolver, not an imposter. This prevents DNS hijacking attacks where a rogue resolver intercepts your queries.

For maximum privacy, combine DoT with a privacy-focused DNS provider that has a strict no-log policy. Encryption protects your queries in transit, but the resolver still sees them — choosing a provider that does not log queries completes the privacy picture.

Frequently Asked Questions