What DNS over TLS protects — and what it does not
Queries hidden from the network. Every DNS question is sealed inside a TLS-encrypted session, so a network observer cannot read which domain you are resolving — only that encrypted DNS traffic is flowing.
Answers sealed against tampering. The reply travels back through the same encrypted channel, so no one on the path can rewrite it mid-flight and silently redirect your browser.
A dedicated, purpose-built channel. DoT runs on its own reserved port (853), created specifically for DNS over TLS — simple, mature and easy for devices and networks to recognise.
Honest scope: the query, not the IP. Encryption protects the DNS question and answer, but not the destination IP your browser later connects to — DoT does not make the whole connection anonymous.
DoT vs DoH vs DoQ — three ways to encrypt DNS
All three encrypt your DNS, but they carry it differently. AEU DNS supports them all.
DoT = TLS on a dedicated port. DNS wrapped in TLS over TCP port 853 — purpose-built for DNS, mature and easy to identify on a network.
DoH = DNS inside HTTPS. DNS carried over HTTPS on port 443, so it blends in with ordinary web traffic and is hard to block or tell apart from browsing.
DoQ = DNS over QUIC. DNS over the QUIC transport — a faster handshake and no head-of-line blocking, which suits mobile and lossy networks.
Encrypted transport — on by default
AEU DNS carries every query over encrypted DoH, DoT and DoQ transport from the moment you connect, with no setting to toggle. It is a privacy-first European filtering forwarder: it filters ads, trackers and malware, then forwards your query upstream — and never stores logs by design.
Get encrypted DNS in two minutes
Create a free account, get your DNS profile and a personal certificate, and copy-paste one configuration onto any device.
Create your accountKeep exploring
Start from the AEU DNS home page, or read how encrypted DNS works for a plain-language walk-through of how encrypted DNS protects you. See how GDPR-compliant DNS keeps your DNS private and European.
Frequently asked questions
What is DNS over TLS (DoT)?
DNS over TLS wraps your DNS queries and answers in TLS (Transport Layer Security) encryption — the same technology that secures HTTPS websites — and sends them over a dedicated port (853). A network observer sees only encrypted traffic and cannot read which domain you are resolving.
How is DoT different from DoH?
DoT carries DNS inside a TLS session on its own dedicated port (853), while DoH carries DNS inside standard HTTPS on port 443 so it blends in with ordinary web traffic. Both encrypt your queries; they differ in how the traffic is carried and how easy it is to recognise or block.
How is DoT different from DoQ?
DoT runs DNS over TLS on top of TCP, while DoQ runs DNS over the QUIC transport. QUIC connects faster and avoids head-of-line blocking, which can make DoQ feel snappier on mobile or lossy networks. Both encrypt the query end to end.
Does DoT hide my IP address?
No. DoT encrypts the DNS question and answer, but it does not hide the IP address of the DNS server you talk to, nor the destination IP your browser later connects to. It protects the DNS layer from being read, not the whole connection from being identified.
Is AEU DNS a resolver?
No. AEU DNS is a privacy-first filtering forwarder: it filters ads, trackers and malware, validates DNSSEC, then forwards each query to an upstream resolver over encrypted DoH/DoT/DoQ transport. It never stores logs by design.