What are DNS over HTTPS and DNS over TLS, and what problem do they solve?
Plain DNS is unencrypted, so anyone on the path can read and alter your lookups. DNS over TLS (port 853) and DNS over HTTPS (port 443) encrypt the query between you and the resolver, hiding what names you look up from the local network.
Explain it simply
Plain DNS is shouting your question across a crowded room: "where is example.com?" DoH and DoT put the question in a sealed envelope that only the resolver can open.
Example
Plain DNS UDP/TCP 53 visible to Wi-Fi owner, ISP, anyone on the path
DoT TCP 853 encrypted; easy for a network admin to spot and block
DoH TCP 443 encrypted; looks like normal HTTPS trafficWhat it fixes: eavesdropping and tampering between your device and the resolver. What it does not fix: the resolver itself still sees every name you look up, so choosing a trustworthy resolver matters. After the connection starts, the destination IP and often the hostname (SNI) are still visible to the network.
Browsers like Firefox and Chrome can use DoH on their own, which can bypass a school or company's DNS filtering, and some administrators dislike that.
What to say in the interview
"DoT and DoH encrypt DNS queries to the resolver, preventing snooping and tampering on the local path. They do not hide the destination IP and they move trust to the resolver. DoH uses port 443 and blends in with web traffic."
Common mistakes
- Saying DoH makes browsing anonymous.