"Just Wrap It in TLS"
The first major standard to fix the plain-text DNS problem was DNS over TLS (DoT), defined in RFC 7858 (2016). The design philosophy is minimal: take the standard DNS wire format and wrap it inside a TLS tunnel — the same encryption technology that secures HTTPS connections.
How it works mechanically:
1. Your device opens a TCP connection to the recursive resolver on port 853.
2. A TLS handshake occurs. Your device verifies the resolver's certificate, establishing an encrypted channel.
3. DNS queries and responses are sent through this encrypted tunnel in the standard DNS binary format — nothing about the query structure changes, only the transport.
4. The connection can be kept alive (persistent) to amortize the cost of the TLS handshake across multiple queries.
Key Characteristics:
| Property | Value |
|---|---|
| Port | 853 (TCP) |
| Encryption | TLS 1.2 or 1.3 |
| Query format | Standard DNS binary (unchanged) |
| Visibility | Traffic is identifiable as DNS by port number |
| Blockability | Easy — block port 853 at the firewall |
Use Case: DoT is the standard preferred by operating systems and network routers. Android's "Private DNS" feature (Settings → Network → Private DNS) uses DoT. Many home routers support DoT natively, encrypting DNS for every device on the network without any per-device configuration.
The trade-off is transparency: because DoT uses a dedicated port, network administrators can see that DNS lookups are happening (though not what is being looked up). They can also block it entirely by dropping port 853 traffic, forcing devices back to unencrypted DNS on port 53.
Interviewers often ask: "Why does DoT use TCP instead of UDP?" Standard DNS uses UDP for speed (no connection setup). DoT requires TCP because TLS requires a reliable, ordered byte stream to perform its handshake and maintain the encrypted session. The TLS overhead makes the connection-oriented nature of TCP a necessity, not a choice.