DoH vs DoT vs DoQ: encrypted DNS explained

When you type a website name into your browser, your device asks a DNS resolver to translate it into an IP address. That request is called a DNS query. By default, these queries travel in plain text, visible to anyone on the network, including your internet provider. Encrypted DNS fixes that. There are three main protocols: DoH, DoT, and DoQ. This article explains each, compares them, and helps you decide which to use.

What is DoH?

DoH stands for DNS over HTTPS. It sends DNS queries inside normal HTTPS web traffic, using port 443, the same port used for secure websites. Because it blends with other web traffic, it is the hardest to block or interfere with. A network firewall cannot easily distinguish a DNS query from a regular webpage request. DoH is widely supported by browsers and operating systems. Its main downside is that it can be slightly slower due to the extra HTTPS handshake, but in practice the difference is negligible.

What is DoT?

DoT stands for DNS over TLS. It uses a dedicated port, 853, and wraps DNS queries in a TLS encryption layer, similar to what protects your online banking. Because it uses a fixed port, it is simple to implement and very reliable. However, that fixed port also makes it easy for networks to detect and block DoT traffic. If you are on a restrictive network, DoT might not work. DoT is a mature standard and is supported by many routers and DNS clients.

What is DoQ?

DoQ stands for DNS over QUIC. QUIC is a modern transport protocol that powers much of the web today, known for low latency and fast connection establishment. DoQ uses UDP port 443, similar to DoH, but with even lower overhead. It is the newest of the three, so support is still growing. DoQ offers excellent performance and resistance to blocking, but you may need to update your software to use it.

Comparing the three

Here is a quick comparison:

- Blocking resistance: DoH and DoQ are harder to block than DoT because they use port 443 and look like normal web traffic. DoT's fixed port makes it easy to spot.
- Latency: DoQ is designed for low latency, followed by DoH and DoT. In real-world use, differences are often small.
- Maturity: DoT is the most mature, then DoH, then DoQ. DoQ is still being adopted.
- Simplicity: DoT is the simplest to set up on routers. DoH is easy on browsers and apps. DoQ requires newer clients.

Which should you pick?

There is no single best answer. It depends on your situation.

- For maximum privacy at home: Use DoH or DoQ. They are harder for your internet provider to see and block. If your device supports DoQ, it offers the best performance.
- For simple router configuration: DoT is often the easiest to configure on home routers. Many routers have a DoT setting.
- For restrictive networks: If you are on a network that blocks certain DNS ports, DoH or DoQ are more likely to work because they use port 443.
- For business or family filtering: If you want to enforce SafeSearch or content filtering, any of the three will work, but you need a resolver that supports those features.

A note on DNS leaks

Even if you configure an encrypted DNS resolver, your device might still send some queries in plain text to your ISP. This is called a DNS leak. It can happen if your operating system or apps have their own DNS settings. To prevent leaks, make sure your device is configured to use only the encrypted resolver and disable any fallback to plain DNS.

Why choose a European, no-logs resolver?

When you use a public DNS resolver, that resolver can see all your DNS queries. That is why privacy matters. A no-logs resolver, like AEU DNS, does not store any data about your queries. It is based in the EU, so it falls under strict European data protection laws. AEU DNS supports DoH, DoT, and DoQ, so you can use any of the three protocols and still get the same privacy guarantees.

What about other resolvers?

You may have heard of dns0.eu, which shut down in October 2025. Users who relied on it need a replacement. DNS4EU is an EU-backed resolver that is privacy-conscious, but it keeps anonymized, aggregated logs. NextDNS is a capable resolver, but it is based in the US, so it is subject to US jurisdiction. These are all valid options, but if you want a strict no-logs service under EU jurisdiction, AEU DNS is a strong choice.

Conclusion

Encrypted DNS is essential for protecting your online privacy. DoH, DoT, and DoQ each have strengths. DoH is widely supported and hard to block. DoT is simple and mature. DoQ is fast and modern. Choose the one that fits your device and network. And remember, the resolver you choose matters just as much as the protocol. AEU DNS supports all three, so you can switch without changing your privacy level.

Stay safe online, and make sure your DNS is encrypted.