+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: DoH vs DoT? (/showthread.php?tid=6304817)
DoH vs DoT? - schassis - Aug 2, 2025
When should I use DoH instead of DoT or vise versa?
RE: DoH vs DoT? - skull - Aug 3, 2025
Both requests are encrypted.
Only difference is which port I turns over, DoH allows a DNS lookup to run on port 443, simulating a HTTPS request instead of a DNS request.
So use DoH when you wish for your DNS request to blend in with any other HTTPS requests.
RE: DoH vs DoT? - ▄︻デ══━一一一一━ - Aug 4, 2025
(Aug 2, 2025 08:28 PM)schassis Wrote: When should I use DoH instead of DoT or vise versa?
| Transport | HTTPS (TCP 443) | TLS (TCP 853) |
| Visibility to network | Blends into regular HTTPS (harder to distinguish) | Distinct traffic on port 853 (easier to monitor/control) |
| Blocking resistance | Higher in censoring/restrictive networks (looks like normal web) | Lower—can be blocked by filtering port 853 |
| Deployment granularity | Per-app (e.g., browser) or system if supported | Typically system-/router-wide |
| Privacy | Good, but can be centralized by resolver; hidden in HTTPS | Good and more transparent to admins (less hidden layering) |
| Performance | Slightly higher overhead due to HTTP framing | Leaner (no HTTP layer) |
| Policy/control | Harder for enterprises to gate/inspect | Easier to integrate with network policies |
| Typical use case | Individual user privacy on untrusted networks or bypassing filtering | System-wide encrypted DNS in managed or home environments |
Final Thoughts: Use DoT for clean, system-wide encrypted DNS when you control the network or need straightforward policy enforcement; use DoH to blend into HTTPS for censorship resistance or per-application privacy.