DNSCrypt vs DoH vs DoT: Encrypted DNS Protocols Side by Side

How to read the dnscrypt vs doh vs dot matrix

Transport says what carries the encrypted query. DNSCrypt runs directly over UDP and TCP; its specification requires TCP and recommends UDP. DoT wraps DNS in a TLS session over TCP, DoH sends DNS messages inside HTTPS, and DoQ uses a QUIC connection. ODoH is built on DoH, and Anonymized DNSCrypt adds a relay in front of a normal DNSCrypt server.

Port is the number a firewall sees. RFC 7858 assigns TCP port 853 to DoT, and RFC 9250 puts DoQ on UDP port 853. DoH uses port 443 like any HTTPS site, and the DNSCrypt specification recommends port 443 for both UDP and TCP. The page on DNS port numbers explains each one in depth.

Server authentication shows how your client knows it reached the right resolver. DoT and DoH rely on TLS certificates. DNSCrypt uses a provider public key, an Ed25519 key that the client receives through a trusted channel such as a DNS stamp, and checks every short-term resolver certificate against it. No certificate authority is involved.

Blockability describes how easily a network can stop the protocol without breaking other traffic. A dedicated port such as 853 is simple to filter, so DoT is the easiest to block. DoH looks like ordinary HTTPS on port 443. DNSCrypt also listens on 443 by default, but its packets are not TLS, so it is not hidden behind web traffic.

Privacy rows: anonymity and dnscrypt vs dnssec

Client anonymity asks whether the resolver learns both who you are and what you looked up. With DoH, DoT, DoQ and plain DNSCrypt it does. The Anonymized DNSCrypt specification routes encrypted queries through a relay that cannot read them, so the server only sees relay addresses. RFC 9230 gives ODoH the same split for DoH.

The DNSSEC relation row settles the common dnscrypt vs dnssec confusion. DNSSEC signs records so that a validating resolver can detect forgeries, and RFC 4033 notes that it provides no confidentiality. The DNSCrypt specification says the reverse for itself: it protects the resolver link and does not replace DNSSEC validation. Every encrypted protocol in the matrix combines with DNSSEC.

OS-native support lists what works without extra software. Microsoft documents DoH and DoT in the Windows 11 DNS client, Apple announced native DoT and DoH for its platforms at WWDC 2020, and Android’s Private DNS mode has used DoT since Android 9. DNSCrypt is not built into any of these systems and always needs a client.

dnscrypt-proxy support shows what the most widely used DNSCrypt client can speak upstream. Its README lists DNSCrypt v2 (including the post-quantum PQDNSCrypt variant), DoH over TLS 1.3 and QUIC, Anonymized DNSCrypt and ODoH. DoT and DoQ are not on that list, so the column helps if you plan to run dnscrypt-proxy as a local resolver.

Pair comparisons and doh vs dot vs doq

Two pairings get their own pages because they come up most often. DoH vs DoT covers the choice most phones and browsers offer, including where DoQ fits into a doh vs dot vs doq decision. DNSCrypt vs DoH goes into DNSCrypt v2 cryptography, certificates over TXT records and the anonymizing relay modes.

Choosing from the dnscrypt vs doh vs dot matrix

Start with the rows your situation fixes. If a phone must work without extra software, the OS-native row narrows dnscrypt vs doh vs dot to DoT or DoH. If a network filters port 853, the blockability row rules out DoT and DoQ. If hiding your IP address matters, look at Anonymized DNSCrypt and the route builder.