What are DoH and DoT? Can encrypted DNS completely solve DNS pollution?

　　To state the conclusion upfront: DoH and DoT effectively defend against DNS pollution caused by "in-transit man-in-the-middle tampering," but they cannot resolve issues involving "authoritative-side pollution" or the "blocking of the DoH/DoT servers themselves." Many people assume encrypted DNS is useless simply because they find certain websites still won't load after enabling it. In reality, the problem lies not with the encryption itself, but with the fact that the pollution occurs at a stage beyond the scope of what encryption can cover.

　　The Problem with Traditional DNS: Postcard-Style Communication

　　To understand the value of DoH and DoT, one must first clearly grasp the flaws of traditional DNS.

　　Traditional DNS queries operate over UDP port 53, with data packets transmitted entirely in plaintext. When you type a URL into your browser, the query travels from your device to the DNS server; any node along the path—such as an ISP router, a public Wi-Fi gateway, or even another user on the same LAN—can see which domain you are looking up and inject fake data into the response packet.

　　To use an analogy: traditional DNS is like sending a postcard; anyone along the way can glance at the content or easily alter the address. DoH and DoT, however, effectively place that postcard inside an encrypted envelope that only the intended recipient can open and read.

　　DoT: Establishing a Dedicated Encrypted Channel for DNS

　　DoT stands for DNS over TLS. Its approach is straightforward: it retains the original DNS protocol structure but encapsulates the transmission process within a TLS encrypted tunnel.

　　Specifically, DoT utilizes TCP port 853. The client first performs a TLS handshake with the DNS server to establish an encrypted connection, after which all DNS queries and responses are transmitted through this secure channel. Bystanders along the network path see only a stream of encrypted data; they cannot discern which domain is being queried.

　　DoT uses a dedicated port (853). This serves as both an advantage and a disadvantage. The advantage is that network administrators can clearly identify traffic on port 853, making policy management easier; the downside is that in strictly restricted network environments, port 853 might be blocked outright.

　　In terms of deployment, DoT is better suited for system-level configurations—such as on routers, operating systems, and enterprise gateways. It performs DNS encryption "purely," without mixing it with other traffic, resulting in clearer management.

　　DoH: Hiding DNS within standard web traffic

　　DoH stands for DNS over HTTPS, and its approach is more "cunning" than that of DoT: instead of opening a separate port, it encapsulates DNS queries directly into standard HTTPS requests and transmits them via port 443.

　　Since HTTPS is already encrypted, the DNS queries contained within are naturally encrypted as well. More importantly, from the outside, DoH traffic is indistinguishable from ordinary web browsing traffic—both use port 443, TLS encryption, and HTTP requests. Intermediate nodes cannot tell the difference between traffic performing a DNS lookup and traffic accessing a webpage.

　　This characteristic gives DoH a distinct advantage in circumventing network censorship and interference. It is difficult for network operators to identify and block DoH traffic based on port characteristics because it is hidden amidst vast amounts of HTTPS traffic.

　　DoH is typically deployed at the endpoint level—in web browsers and mobile apps. Chrome, Firefox, and Edge all have built-in DoH support; once enabled by the user, all domain name resolution performed by the browser travels through an encrypted channel.

　　The core difference between DoH and DoT: Two ways to send a "postcard"

　　To understand the difference between the two, consider this analogy:

　　DoT is like renting a dedicated, secure courier line (port 853) to send a confidential letter. The security guards know it is a "secure channel" but do not know the contents of the letter. This dedicated line is exclusive; while it is easily noticed, it is also easy to manage. DoH, on the other hand, involves tucking the message into an ordinary shipping box (using port 443) and sending it out mixed in with thousands of identical boxes. No one knows which box contains your message, nor does anyone know what is written inside. It offers greater stealth but is more complex to manage.

　　To summarize the core differences between the two:

　　1. Different ports: DoT uses port 853, while DoH uses port 443. The former is easily identified, whereas the latter blends in with standard traffic.

　　2. Different deployment scenarios: DoT is suited for the system level (routers, enterprise gateways), prioritizing controllability and ease of management; DoH is suited for the endpoint level (browsers, mobile apps), prioritizing privacy and resistance to interference.

　　3. Different visibility for network management: DoT’s dedicated port allows administrators to monitor and filter DNS traffic; DoH hides everything within HTTPS, rendering traditional content filtering and auditing methods largely ineffective.

　　What exactly does encrypted DNS protect against?

　　Scenarios it prevents: Man-in-the-middle (MITM) attacks on the network path.

　　This is the primary defense scenario for both DoH and DoT. If DNS poisoning occurs along the path between you and the DNS server—such as an ISP tampering with response packets at a backbone node, or a public Wi-Fi gateway forging resolution results—encrypted DNS provides effective protection.

　　Empirical data supports this: in network environments prone to DNS poisoning, enabling DoH can reduce the error rate in DNS resolution from an average of 12.7% to below 0.3%. Joint data from Mozilla and Cloudflare also indicates that enabling DoH reduces the risk of DNS query leakage by more than 95%.

　　Attackers cannot see what you are querying, nor can they inject fake data into the encrypted channel. TLS integrity checks ensure that response packets remain untampered with during transmission. Scenarios Where Protection Fails: Three Situations Where DoH/DoT Are Powerless

　　Scenario 1: The DoH/DoT server itself is blocked

　　This is a very real issue. The protection provided by encrypted DNS is limited to the segment between your device and the DoH/DoT server. If you cannot connect to the DoH server in the first place, encryption is moot.

　　In certain network environments, the IP addresses or domain names of well-known DoH service providers may be blocked. TLS connections initiated to these services may be interfered with or severed, preventing DoH requests from ever reaching the server. Crucially, if the DoH connection fails, the browser might fall back to plaintext DNS, rendering the encryption protection useless.

　　Scenario 2: The authoritative DNS server is poisoned

　　DoH/DoT servers themselves must query authoritative DNS servers to obtain resolution results. If the poisoning occurs at the authoritative level—such as the authoritative DNS server being compromised or the link between the DoH server and the authoritative server being tampered with—the DoH server receives an incorrect result and then securely transmits it back to you.

　　Encryption protects the "transmission process," not the "correctness of the resolution result." Microsoft's official documentation explicitly states: "Sometimes, incorrect resolution results are caused by the DNS server itself being poisoned; this is unavoidable."

　　Scenario 3: The target IP is directly blocked

　　DoH/DoT is only responsible for translating a domain name into an IP address. Once translated, you still need to connect to that IP. If the target website's IP address itself is blocked, encrypted DNS cannot help. It solves problems in the "translation phase" but not in the "connection phase."

　　Practical Configuration: How to Enable DoH in Browsers

　　Mainstream browsers like Chrome, Firefox, and Edge have built-in DoH support.

　　Chrome: Enter `chrome://settings/security` in the address bar, locate "Use secure DNS," enable it, and enter the DoH endpoint address—for example, `https://dns.cloudflare.com/dns-query`. Firefox: Enter `about:preferences#privacy` in the address bar and locate the "DNS over HTTPS" section. Three protection levels are available: Default Protection (fallback to system DNS if issues arise), Enhanced Protection (forced DoH), and Maximum Protection (error message upon connection failure).

　　Edge: Enter `edge://settings/privacy` in the address bar, enable "Use secure DNS," and select a service provider or a custom endpoint.

　　Once configured, you can use a diagnostic tool to verify if DoH is active. If the results show the DNS server address has changed to your configured DoH provider, encryption is successfully in effect.

　　DoH and DoT act as an "encrypted envelope" for DNS queries, effectively preventing eavesdropping and tampering during transit. However, encryption is ineffective if DNS poisoning occurs before the envelope reaches its destination (at the authoritative server level) or if the query cannot be sent at all (e.g., the server is blocked). Encrypted DNS is a crucial step for privacy protection, but it is not a cure-all for DNS security issues.