In short
Encrypted DNS sends DNS lookups inside an encrypted connection so nobody on the network can read or alter them. The two main standards are DNS over HTTPS (DoH, port 443) and DNS over TLS (DoT, port 853). For organisations the aim is to keep encryption but point it at your protective DNS resolver, not a public one.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What encrypted DNS is
Traditional DNS is sent in plain text, normally over UDP or TCP port 53. Anyone on the same network path, from a coffee-shop Wi-Fi operator to an attacker on a compromised router, can see which names a device looks up and, in some cases, change the answers. Microsoft's own documentation puts it plainly: unencrypted DNS on port 53 exposes DNS traffic to passive monitoring, traffic analysis and active manipulation.
Encrypted DNS wraps the same DNS questions and answers in an encrypted, authenticated connection between the device and its resolver. The DNS message itself does not change; only the way it travels does. Three IETF standards are in use:
- DNS over TLS (DoT), RFC 7858 (2016): DNS inside a TLS connection on its own dedicated port, TCP 853.
- DNS over HTTPS (DoH), RFC 8484 (2018): DNS messages sent as HTTPS requests, normally on port 443 alongside ordinary web traffic.
- DNS over QUIC (DoQ), RFC 9250 (2022): DNS over the QUIC transport on UDP port 853. Less common today, but worth knowing for firewall rules.
Encryption protects the lookup in transit. It does not decide whether a domain is safe to visit, and it does not prove the answer came from the domain's real owner: those are the jobs of protective DNS and DNSSEC respectively.
DNS over HTTPS vs DNS over TLS
Both protocols give the same basic protections: the lookup is confidential, it cannot be altered in transit, and the device can check it is talking to the resolver it expects. The practical difference for an IT team is how visible and controllable each one is.
| DNS over HTTPS (DoH) | DNS over TLS (DoT) | |
|---|---|---|
| Standard | RFC 8484 | RFC 7858 |
| Port | 443, shared with all HTTPS web traffic | 853, dedicated to DNS |
| Visible to a firewall as DNS? | No. It looks like any other HTTPS connection | Yes. Traffic on port 853 is clearly encrypted DNS |
| Easy to block if unwanted? | Harder: block known DoH services by name or category, and manage device settings | Easier: block outbound port 853 except to your resolver |
| Where you meet it | Browsers (Secure DNS settings), Windows 11 DNS client, many apps, some malware | Android Private DNS, some routers and resolvers, some DNS filtering agents |
| Typical enterprise use | Roaming agents and browsers pointed at the company's protective resolver | Encrypting lookups from a site or device to the protective resolver |
So "DNS over HTTPS vs DNS over TLS" is less about which is more secure and more about control. DoT sits on its own port, so a firewall can allow it to your chosen resolver and refuse it everywhere else. DoH blends into normal web traffic, which is good for privacy on hostile networks and awkward for anyone who needs to enforce DNS policy. Our guide to DNS over HTTPS goes deeper on DoH specifically.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
The privacy gain and the visibility problem
For an individual on public Wi-Fi, encrypted DNS is a clear win: the person running the network can no longer read or tamper with their lookups. The Chromium team's announcement of Chrome's Secure DNS made exactly this case, pointing to attackers on shared connections such as public Wi-Fi.
For an organisation, the same feature can cut across your own controls. Many security tools depend on seeing or answering DNS:
- Protective DNS and DNS filtering only work on lookups that reach your resolver. A browser or app sending DoH to its own public resolver skips your policy entirely.
- DNS logs that feed your SIEM or incident response go quiet for those lookups, so a device talking to a command-and-control domain may not show up.
- Split DNS and internal names can break when a browser resolves names through an outside resolver that knows nothing about your internal zones.
- Safeguarding filters in schools can be bypassed, which is why the UK Safer Internet Centre lists DNS over HTTPS among the circumvention techniques a school filter should identify and manage.
The NCSC's guidance on protective DNS for the private sector deals with this directly. It recommends blocking outbound DNS on port 53 or 853 that does not go via your protective resolver, and making sure DoH is either disabled on client operating systems or configured to go via the protective resolver in a way that still allows logging. The practical steps are on our page about whether to block DNS over HTTPS.
Where encrypted DNS turns up
You will meet encrypted DNS in more places each year. The main ones to plan for:
| Where | What happens | How you control it |
|---|---|---|
| Web browsers | Chrome and Edge offer a Secure DNS setting that uses DoH; Firefox has its own DoH settings | Browser policies via Group Policy or MDM; see secure DNS |
| Windows | Windows 11 is a DoH-capable client; Windows Server 2025's DNS Server role gained DoH in a 2026 update | Windows DNS settings and the DNS Client Group Policy |
| Android | Private DNS uses DNS over TLS and, by default, upgrades automatically if the network's resolver supports it | MDM, plus blocking port 853 to anything but your resolver |
| Apps | Apps can carry their own DoH resolver and ignore the operating system's settings | Block known DoH services by category; application allow lists |
| Malware | Malware can use DoH to hide its command-and-control lookups | Endpoint protection, egress controls and DoH category blocking |
| Protective DNS agents | Some roaming agents encrypt their own lookups to the protective resolver | This is the encrypted DNS you want: keep it |
Encrypted DNS is also only one half of the privacy picture. The website name has historically also leaked in the TLS handshake itself, and Encrypted Client Hello closes that gap too. Together they remove a lot of the visibility that network-only filtering relied on, which is why device-level controls matter more each year.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
How protective DNS services use encrypted DNS
The answer is not to fight encryption but to make sure encrypted lookups go to a resolver that applies your policy. The services we supply and the NCSC's own PDNS already do this in different ways:
| Service | Encrypted DNS support (per the vendor or NCSC) |
|---|---|
| NCSC PDNS Roaming | Sends DNS from Windows, macOS and iOS devices to PDNS over DNS over HTTPS. See NCSC PDNS |
| Cisco Umbrella | Cisco documents a DoH front end for Umbrella's standard DNS service; the Low content preset includes encrypted DNS and filter avoidance categories, which help block third-party DoH services. Umbrella is now evolving into Cisco Secure Access DNS Defense; see Cisco DNS-layer security |
| DNSFilter | Lists DNS encryption, including DNS over TLS, among its capabilities |
| Webroot DNS Protection | The agent supports DNS over HTTPS and IPv6, so filtering continues on modern networks. See Webroot DNS Protection explained |
| Sophos DNS Protection for endpoints | The Sophos Endpoint agent intercepts lookups on Windows devices and forwards them to the service over HTTPS |
What these have in common is that the device sends encrypted lookups to a resolver you control the policy on, and everything else is blocked or switched off. That is the model the NCSC describes, and it is what we can help you set up. Our DNS roaming client guide compares the agents in more detail, and DNS security solutions compares the services themselves.
How we help
Forever Systems is a Cisco Partner and supplies several protective DNS services. We can help you:
- Find out where encrypted DNS is already in use on your network and devices, using your firewall and DNS logs.
- Choose a protective DNS service whose agents and resolvers support the encrypted protocols you need.
- Set browser and operating system policies so Secure DNS and DoH point at your protective resolver, or are switched off where that suits you better.
- Tighten firewall rules for ports 53 and 853 and block known third-party DoH services by category.
- Test the result on site, at home and on guest Wi-Fi, using the checks in our DNS security test guide.
Exactly what we deliver, and how, is confirmed at quote. Contact us to talk through your setup; pricing depends on users, devices and the service you choose, so ask us for a quote.
Encrypted DNS guides
How Forever Systems helps with DNS security
We are an independent UK IT and cyber security provider and a Cisco Partner. We supply Cisco Umbrella and Cisco Secure Access DNS Defense, and a range of other DNS filtering options, so we can recommend what fits rather than one answer for everyone.
- Start with what you have: we look at your firewall, endpoint protection and Microsoft 365 licences first, as some already include DNS or web filtering
- Choosing a service: Cisco DNS-layer security, DNS filtering bundled with endpoint protection, or a protective DNS service from the public sector, compared in plain English
- Set-up and roll-out: network forwarding, roaming clients for laptops off site, policies, block pages and controls to stop encrypted DNS bypassing the filter
- Migration help, including planning a move from Umbrella DNS packages to Cisco Secure Access DNS Defense
- Ongoing help: policy changes, reporting reviews, licence management and renewals, agreed at quote
We work with businesses, schools, charities and public sector organisations.
Frequently asked questions
What is encrypted DNS?
Encrypted DNS sends DNS lookups inside an encrypted connection between a device and its resolver, so other people on the network cannot read or change them. The main standards are DNS over HTTPS (DoH), DNS over TLS (DoT) and, less commonly, DNS over QUIC (DoQ).
What is the difference between DoH and DoT?
Both encrypt DNS. DNS over TLS uses its own port, 853, so it is easy to see and to allow or block at the firewall. DNS over HTTPS uses port 443 and looks like ordinary web traffic, which helps privacy but makes it harder for an organisation to control.
Does encrypted DNS stop DNS filtering?
It can. If a browser or app sends encrypted lookups to its own public resolver, your DNS filter does not see them. If the encrypted lookups go to your protective DNS resolver, filtering carries on as normal. The fix is to point encryption at your resolver and block the rest.
Which port does DNS over TLS use?
DNS over TLS uses TCP port 853 (RFC 7858). DNS over QUIC also uses port 853, over UDP. DNS over HTTPS normally uses port 443, the standard HTTPS port. Plain DNS uses port 53.
Are encrypted DNS servers safer than normal DNS servers?
They are safer in transit, because lookups cannot be read or changed on the way. They are not necessarily safer in what they resolve: an encrypted public resolver may still answer for phishing or malware domains. Protective DNS adds the blocking; encryption protects the journey.
Still have a question about DNS encryption?
Ask us and a member of our team will reply by email.