# DoH and DoT ## Encrypting DNS does not hide the question, it changes who gets to hear it Classic DNS travels in plaintext on port 53. Anyone on the path reads every query: the ISP, a transit provider, anyone with a tap. **DoT**, DNS-over-TLS, wraps queries in TLS on a dedicated port. It is encrypted and still identifiable as DNS, so a network operator can see that it is happening and block or permit it. **DoH**, DNS-over-HTTPS, sends queries as ordinary HTTPS traffic on port 443, indistinguishable from web browsing. A network operator cannot separate it from everything else without breaking TLS. > [!important] The shift, stated precisely > Encryption does not remove the observer. It ==relocates== it. The query is still fully visible to whichever resolver terminates the connection, and that resolver is now frequently chosen by the browser or the operating system rather than by the network the device sits on. Visibility moves from the ISP to whoever the application vendor picked. > [!danger] The constraint on passive collection > Any product claiming to mirror or analyse raw DNS traffic from a network tap has a hole in it. A device using DoH to an external resolver produces ==nothing readable at that tap==. The traffic is there and it looks like HTTPS. > > Worth having in your back pocket when evaluating a DNS security vendor. The correct question is: do you collect at the resolver, or from the wire. Resolver-side collection survives encryption because the resolver is the endpoint. Wire-side collection degrades as DoH adoption rises, and it is rising. ## Why it matters Two consequences. For security teams, wire-based DNS monitoring has a decaying shelf life, and the architecture has to move to the resolver, which means you must operate a resolver the devices actually use. For sovereignty, encrypted DNS is a double edge. It protects the query in transit from a foreign transit provider, and it simultaneously makes it far easier for a device to silently route its queries to a foreign resolver, bypassing the national one entirely. Encrypting the channel does not localise the log. ## Related - [[DNS Resolution Mechanics]] - [[The Resolver as Sovereignty Chokepoint]] - [[DNS as a Security Signal]] - [[TLS]] - [[Digital Certificates - SSL,TLS,HTTPS]] - [[Encryption]]