Compare DNS-over-HTTPS (DoH) vs DNS-over-TLS (DoT) for network privacy.
❓ Interview Prompt: Compare DNS-over-HTTPS (DoH, port 443 HTTP/2 payload) vs DNS-over-TLS (DoT, port 853 TLS wrapper), enterprise filtering, and privacy.
Standard DNS queries ('port 53') are sent in unencrypted plain text, allowing ISPs and network eavesdroppers to log every domain visited:
| Feature | DNS-over-HTTPS (DoH - RFC 8484) | DNS-over-TLS (DoT - RFC 7858) |
|---|---|---|
| Port & Protocol | Port 443 (HTTP/2 / HTTP/3 over TLS) | Dedicated Port 853 (TLS Encrypted TCP) |
| Traffic Disguise | Blends in with standard HTTPS traffic | Easily identified and blocked by network firewalls |
| Enterprise Control | Harder to filter/inspect at network edge | Easy for enterprise firewalls to inspect or block |
| Browser Support | Integrated directly into Chrome/Firefox | Supported natively at OS level (Android/iOS) |
Code Implementation Example
// Resolving DNS using DNS-over-HTTPS (DoH) via Cloudflare API
export async function resolveDoh(domain: string) {
const res = await fetch('https://cloudflare-dns.com/dns-query?name=${domain}&type=A', {
headers: { Accept: 'application/dns-json' }
});
return await res.json();
}Use DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) to prevent network eavesdroppers from monitoring DNS queries.