DNS Security and DoH/DoT Complete Guide 2026

Introduction

The Domain Name System (DNS) is one of the most fundamental components of the internet. It translates human-readable domain names into IP addresses that computers use to communicate. Despite its critical importance, DNS was designed in 1983 without security considerations.

Today, DNS faces numerous threats: DNS hijacking redirects users to malicious sites, DNS-based malware uses DNS for command and control, DNS tunneling exfiltrates data through DNS queries, and surveillance of DNS traffic reveals browsing activity.

This comprehensive guide explores DNS security in depth: the threats facing DNS, protective technologies including DNS over HTTPS (DoH), DNS over TLS (DoT), and DNSSEC, and implementation strategies for both enterprises and individuals.

Understanding DNS

How DNS Works

DNS operates as a distributed database mapping domain names to IP addresses. When you type “example.com” in your browser, your device queries DNS servers to resolve that domain to an IP address.

The resolution process involves multiple steps. The operating system checks its local cache. If not found, it queries a recursive resolver (typically provided by your ISP or network). The recursive resolver queries root servers, top-level domain servers, and authoritative servers until it obtains the answer.

This process happens for every domain lookup, making DNS a critical infrastructure component.

DNS Record Types

Several DNS record types are relevant to security.

A records map domain names to IPv4 addresses. AAAA records map to IPv6 addresses. CNAME records create aliases pointing to other domains. MX records specify mail servers. TXT records hold arbitrary text for various purposes including security verification.

Understanding these records helps when investigating DNS-based threats.

Traditional DNS Vulnerabilities

DNS was designed for functionality, not security. Several vulnerabilities exist.

DNS queries are sent in plaintext. Anyone between your device and the DNS server can see which domains you’re requesting.

DNS responses are not cryptographically verified. Attackers can inject fake responses, redirecting traffic to malicious servers.

DNS caching can be poisoned. Attackers can inject false records into resolver caches.

These vulnerabilities enable numerous attacks that compromise privacy and security.

DNS Security Threats

DNS Hijacking

DNS hijacking redirects DNS queries to attacker-controlled servers. This can occur through compromised routers, malware on endpoints, or attacks on DNS resolvers.

Victims who believe they’re visiting legitimate websites are actually connecting to imposters. This enables phishing, malware delivery, and data theft.

DNS Tunneling

DNS tunneling encodes data within DNS queries and responses. Attackers use this technique to exfiltrate data from compromised networks or establish command-and-control channels.

DNS tunneling is particularly insidious because DNS is often allowed through firewalls. Organizations may block HTTP/HTTPS traffic while permitting DNS, creating an exfiltration pathway.

DNS-Based Malware

Malware uses DNS for various malicious purposes. Some malware receives instructions through DNS TXT records. Other malware uses DNS queries to locate command-and-control servers.

Because DNS is essential for network connectivity, blocking DNS breaks legitimate applications. This makes DNS-based threats difficult to mitigate.

DNS Spoofing/Cache Poisoning

DNS spoofing injects false records into DNS resolver caches. Once poisoned, users receive incorrect responses until the cache expires.

This attack can redirect traffic to malicious servers or cause denial of service by providing non-existent addresses.

Privacy Concerns

Even without malicious intent, DNS queries reveal browsing activity. ISPs, network operators, and anyone monitoring network traffic can see which domains users visit.

This privacy concern has driven development of encrypted DNS protocols.

DNS over TLS (DoT)

What Is DoT?

DNS over TLS (DoT) encrypts DNS queries using TLS transport. Rather than sending DNS requests in plaintext over UDP port 53, DoT uses TCP port 853 with TLS encryption.

The encryption prevents eavesdropping on DNS queries. Even if attackers intercept network traffic, they cannot see which domains are being resolved.

How DoT Works

DoT establishes a TLS connection between the client and the DNS resolver. The client validates the resolver’s certificate to prevent man-in-the-middle attacks.

After establishing the TLS tunnel, DNS queries and responses flow through the encrypted channel. The protocol is relatively simple—the same DNS messages are wrapped in TLS.

import socket
import ssl

def query_dns_over_tls(domain, dns_server="8.8.8.8"):
    """Query DNS over TLS."""
    # Create TLS context
    context = ssl.create_default_context()
    
    # Connect to DNS server over TLS
    with socket.create_connection((dns_server, 853)) as sock:
        with context.wrap_socket(sock, server_hostname=dns_server) as ssock:
            # Build DNS query (simplified)
            transaction_id = b'\x00\x01'
            flags = b'\x01\x00'
            questions = b'\x00\x01'
            answer_rrs = b'\x00\x00'
            authority_rrs = b'\x00\x00'
            additional_rrs = b'\x00\x00'
            
            domain_parts = domain.split('.')
            query = transaction_id + flags + questions + answer_rrs + authority_rrs + additional_rrs
            for part in domain_parts:
                query += bytes([len(part)]) + part.encode()
            query += b'\x00'  # End of domain
            query += b'\x00\x01'  # Type: A record
            query += b'\x00\x01'  # Class: IN
            
            # Send length prefix and query
            length = len(query).to_bytes(2, 'big')
            ssock.send(length + query)
            
            # Receive response
            length_bytes = ssock.recv(2)
            response_length = int.from_bytes(length_bytes, 'big')
            response = ssock.recv(response_length)
            
            return response

DoT Advantages

DoT provides encryption for DNS queries, protecting privacy. It prevents network observers from seeing domain lookups.

DoT is standardized (RFC 7858) and supported by major operating systems. Implementation is straightforward for organizations that control their DNS infrastructure.

DoT Limitations

DoT uses a dedicated port (853) that can be blocked by firewalls. Some networks restrict outbound connections to standard ports only.

DoT provides encryption but does not validate DNS responses. Additional mechanisms like DNSSEC are needed for response validation.

DNS over HTTPS (DoH)

What Is DoH?

DNS over HTTPS (DoH) encrypts DNS queries by transmitting them over HTTPS. DNS queries become HTTP requests to special DoH endpoints.

DoH uses port 443, the same port as regular HTTPS traffic. This makes DoH traffic indistinguishable from normal web traffic, providing both encryption and privacy from network observers.

How DoH Works

DoH encodes DNS queries as HTTP GET requests. The domain to resolve is encoded in a JSON payload or as a path parameter.

The DoH server responds with DNS data encoded in JSON or application/dns-message format. Both request and response are encrypted within the HTTPS connection.

import requests

def query_dns_over_https(domain, doh_server="https://cloudflare-dns.com/dns-query"):
    """Query DNS over HTTPS."""
    headers = {
        'accept': 'application/dns-json'
    }
    
    params = {
        'name': domain,
        'type': 'A'
    }
    
    response = requests.get(doh_server, headers=headers, params=params)
    return response.json()

DoH Advantages

DoH provides strong encryption and privacy. Network observers cannot distinguish DNS queries from other HTTPS traffic.

DoH is harder to block than DoT because it uses standard HTTPS port. Firewalls typically allow outbound HTTPS, making DoH more accessible.

Major browsers support DoH, enabling widespread deployment. Cloudflare, Google, and Quad9 offer public DoH services.

DoH Limitations

DoH can interfere with network security monitoring. Security tools that inspect DNS traffic cannot see DoH queries.

Some enterprise security solutions depend on DNS visibility. DoH deployment may require additional considerations.

DoH increases latency slightly due to HTTPS overhead. For most applications, this impact is minimal.

DoH vs DoT Comparison

When to Use Each

DoT is appropriate when: you control both client and resolver, you need simpler implementation, or you can manage firewall rules.

DoH is appropriate when: privacy is paramount, you need to work around restrictive firewalls, or you want browser-based deployment.

Many organizations implement both, supporting DoH for browsers and DoT for other applications.

DNSSEC

What Is DNSSEC?

DNS Security Extensions (DNSSEC) add cryptographic signatures to DNS data. Rather than encrypting queries, DNSSEC validates that responses originate from authoritative sources and haven’t been tampered with.

DNSSEC addresses different threats than DoH/DoT. While DoH/DoT protect query privacy, DNSSEC ensures response authenticity.

How DNSSEC Works

DNSSEC uses public key cryptography to sign DNS records. Authoritative DNS servers sign their zones with private keys. Resolvers validate signatures using public keys published in DNS.

The validation chain includes: zone signing keys (ZSK) for regular records, key signing keys (KSK) for signing ZSKs, and trust anchors for root zone.

When DNSSEC is enabled, resolvers validate responses before returning them to clients. Invalid responses are discarded.

DNSSEC Deployment

DNSSEC requires deployment throughout the DNS chain: authoritative servers must sign zones, recursive resolvers must validate signatures, and clients must support DNSSEC validation.

Root zone signing began in 2010. Most top-level domains are now signed. Many authoritative DNS providers support DNSSEC signing.

Client support varies. Android has built-in DNSSEC validation. iOS and macOS have limited support. Browser support is minimal.

DNSSEC Limitations

DNSSEC doesn’t provide encryption—DNS data is still visible. It only validates authenticity.

Deployment complexity has slowed adoption. The validation chain requires coordination across the entire DNS ecosystem.

Some middleboxes interfere with DNSSEC, causing resolution failures. This has limited enterprise adoption.

DNS-Based Threat Protection

DNS Firewall

DNS firewalls intercept malicious DNS queries and provide safe responses. When a client queries a known malicious domain, the DNS firewall returns NXDOMAIN or redirects to a block page.

This approach blocks malware at the DNS level, before it can connect to malicious servers. It’s particularly effective for blocking command-and-control domains.

DNS Security Services

Cloud-based DNS security services provide threat intelligence and filtering. These services resolve DNS queries while checking against threat databases.

Popular services include: Cisco Umbrella (OpenDNS), Cloudflare Gateway, Quad9, and Google Public DNS with security filtering.

These services combine DoH/DoT with threat intelligence, providing both privacy and security.

Selective DNS Filtering

Organizations can implement selective DNS filtering based on their requirements.

Internal DNS servers can block known malicious domains. Forwarders can send certain queries to different resolvers based on domain categories.

This approach provides flexibility while maintaining security.

Implementation Strategies

For Individuals

Individual users can implement DNS security through several approaches.

Enable DoH or DoT in your operating system. Most modern operating systems support encrypted DNS. Choose a trusted DNS provider.

Use browsers with DoH support. Chrome, Firefox, and Edge support DoH. Configure your preferred DoH provider.

Consider privacy implications. Encrypted DNS protects from network observers but shifts trust to your DNS provider.

For Enterprises

Enterprise implementation requires more planning.

Evaluate DNS traffic flows. Understand where DNS queries originate and what resolution is used.

Deploy encrypted DNS for appropriate traffic. Browser DoH may bypass enterprise security. Consider controlled DoH deployments.

Implement DNS security services. Use DNS firewalls or cloud security services to block malicious domains.

Maintain DNS visibility for security monitoring. Ensure security tools can access DNS data even with encrypted DNS.

DNS Provider Selection

Choosing a DNS provider involves tradeoffs.

Public DNS providers like Cloudflare (1.1.1.1), Google (8.8.8.8), and Quad9 offer privacy and speed. Some provide security filtering.

Enterprise DNS providers offer additional features including security, analytics, and support.

ISPs may provide DNS but typically offer limited privacy. Consider alternatives for sensitive traffic.

Best Practices

Enable Encryption

Enable DoH or DoT wherever possible. This protects DNS queries from eavesdropping and manipulation.

Configure your devices and browsers to use encrypted DNS. Most modern systems support this.

Validate Responses

Enable DNSSEC validation where supported. This ensures DNS responses are authentic.

Keep systems updated to maintain DNSSEC validation capabilities.

Monitor DNS Traffic

Even with encrypted DNS, monitor for anomalies at your DNS resolvers. Look for unusual query patterns that may indicate compromise.

Implement logging and alerting for DNS-related security events.

Use Secure Providers

Choose DNS providers with strong privacy policies. Understand what data they collect and how they use it.

Consider using providers that don’t log queries or have been independently audited.

Implement Defense in Depth

DNS security is one layer. Combine encrypted DNS with other security controls: endpoint protection, network security, and user training.

No single control provides complete protection.

Challenges and Considerations

Performance Impact

Encrypted DNS adds latency compared to plaintext DNS. The overhead includes TLS handshake, potentially longer resolution times.

For most users, this impact is minimal. Performance-critical applications may require optimization.

Compatibility Issues

Some networks and applications don’t support encrypted DNS. Network administrators may block DoH/DoT.

Test deployments thoroughly to ensure functionality.

Privacy Tradeoffs

Encrypted DNS shifts trust from network operators to DNS providers. Your DNS provider sees your query history.

Evaluate providers carefully and understand their privacy practices.

Operational Complexity

Enterprise DNS security implementation adds complexity. Multiple systems, policies, and monitoring tools must work together.

Plan for training and ongoing management.

The Future of DNS Security

Encrypted DNS Adoption

Encrypted DNS adoption is accelerating. Major browsers and operating systems are enabling it by default.

This trend will continue as privacy concerns grow and encryption becomes standard.

Post-Quantum DNS

As quantum computing advances, current cryptographic methods may become vulnerable. Research into post-quantum DNS security is beginning.

Standards development will address these future threats.

DNS Privacy Regulations

Regulations may address DNS privacy. Current approaches vary by jurisdiction.

Organizations should monitor regulatory developments that may affect DNS implementations.

Integrated Security

DNS security will increasingly integrate with broader security platforms. DNS as a security service will provide more comprehensive protection.

The boundary between DNS resolution and security will continue to blur.

External Resources

• IETF DNS-over-HTTPS - DoH specification
• IETF DNS-over-TLS - DoT specification
• DNSSEC Resources - DNSSEC information
• Cloudflare DNS - Public DNS service
• Quad9 - Security-focused DNS

Conclusion

DNS security is essential for protecting privacy and preventing attacks. The combination of encrypted DNS (DoH/DoT), DNSSEC validation, and DNS-based threat protection provides comprehensive defense.

Individual users should enable encrypted DNS in their devices and browsers. Organizations should implement DNS security as part of a defense-in-depth strategy.

The transition from plaintext DNS to encrypted DNS is underway. As adoption accelerates, the internet becomes more private and secure.

Understanding DNS security options and implementing appropriate protections is a fundamental step in securing your digital presence.