---
title: "How to Configure DNS over TLS vs DNS over HTTPS"
url: "https://astraguardvpn.com/blog/how-to-configure-dns-over-tls-vs-dns-over-https"
description: "Learn to set up DNS over TLS (DoT) and DNS over HTTPS (DoH) with examples. Understand ports, resolvers, and client setup in this detailed guide."
updated: "2026-07-23T09:00:13.851Z"
---

# How to Configure DNS over TLS vs DNS over HTTPS

Explore DNS over TLS vs DNS over HTTPS configurations with practical examples and deep technical insights.

Technical Background Domain Name System (DNS) is a fundamental part of internet infrastructure, translating human-readable domain names into IP addresses. Traditional DNS queries are unencrypted, which can expose user activity to eavesdroppers. To address privacy concerns, DNS over TLS (DoT) and DNS over HTTPS (DoH) have been developed. Both protocols encrypt DNS queries, but they operate differently. DNS over TLS (DoT) uses Transport Layer Security (TLS) to encrypt DNS traffic between the client and the DNS server. It operates over a dedicated port, typically port 853, providing a secure channel for DNS communication. This method is favored for its simplicity and focus on DNS traffic. DNS over HTTPS (DoH), on the other hand, wraps DNS queries within HTTPS traffic, using port 443. This disguises DNS traffic as regular web traffic, which can help bypass DNS-based censorship. However, this can also lead to DNS queries being mixed with other web traffic, potentially complicating network management. Step By Step Before You Start Ensure you have administrative access to your system and familiarity with command-line interfaces. Always back up configuration files before making changes. For Windows: 1. Open PowerShell as Administrator. 2. Install a DoH client, such as "dnscrypt-proxy". 3. Configure the client to use a DoH server, e.g., "cloudflare-dns.com". 4. Start the service and verify DNS queries are encrypted. For Linux: 1. Install "stubby" for DoT support using package managers like APT or YUM. 2. Edit /etc/stubby/stubby.yml to include your preferred DoT server. 3. Restart stubby service to apply changes. 4. Verify DNS resolution through a secure channel. Worked Example Example: DoT Configuration on Linux Command: sudo apt install stubby Command: sudo nano /etc/stubby/stubby.yml Example Configuration: upstream_recursive_servers: - address_data: 10.8.0.2 tls_port: 853 tls_auth_name: "dns.example.com" Command: sudo systemctl restart stubby Configuration Or Command Reference - tls_port 853 — Port used by DoT for secure DNS communication. - tls_auth_name — Server name for TLS authentication. - dnscrypt_proxy.toml — Configuration file for DNSCrypt Proxy. - listen_addresses — Local IP and port where the service listens. - doh_servers — List of DoH servers to query. Troubleshooting Symptom: DNS queries are not encrypted. Cause: Misconfigured DNS client settings. Fix: Check configuration files for correct server addresses and ports. Symptom: Service fails to start. Cause: Port conflict or incorrect permissions. Fix: Ensure no other service is using the same port and check user permissions. Symptom: Slow DNS resolution. Cause: High network latency or server issues. Fix: Switch to a different DNS server or check network performance. Related Concepts And Further Reading - DNSSEC (Domain Name System Security Extensions) - TLS Handshake Process - HTTPS vs HTTP - Encryption Algorithms - Network Traffic Analysis Key Takeaways • DNS over TLS and DNS over HTTPS both encrypt DNS queries for privacy. • DoT uses port 853, focusing solely on DNS traffic. • DoH uses port 443, blending DNS traffic with web traffic. • Configuration requires modifying system settings and understanding network ports. • Troubleshooting involves checking configurations and network conditions. FAQ Q: What is the main advantage of DoH over DoT? A: DoH can bypass DNS-based censorship by blending DNS queries with regular HTTPS traffic. Q: Can DoT be used on mobile devices? A: Yes, many mobile operating systems and apps support DoT. Q: Is it possible to switch between DoT and DoH easily? A: Yes, by configuring your DNS client to use different protocols, you can switch as needed.

---

[More articles](https://astraguardvpn.com/blog) · [VPN plans](https://astraguardvpn.com/packages)