DoH, DoT, DoQ, DoH3, and ODoH: which one should you use?

Every time you open a website, your device first asks a DNS resolver where to find it. Without encryption that question travels in the clear, readable by your internet provider, by the café Wi-Fi, and by everyone else handling the traffic along the way. Taken together, those questions are a running list of every site you visit.

DoH, DoT, DoQ, and DoH3 all encrypt the question so that only your resolver can read it. What separates them is how the encrypted question gets carried, which decides whether it works at all on a given network. ODoH answers a different problem, so it comes last.

DNS-over-TLS (DoT)

DoT carries encrypted DNS on a dedicated port, 853. That dedicated port keeps it simple to implement and just as simple to block, since a network can close one port and leave everything else working, which is what some hotel, airport, and office networks do. DoT is the protocol behind Android’s “Private DNS” setting and the DNS field on most routers.

DNS-over-HTTPS (DoH)

DoH sends the same question over port 443, the port your browser already uses for every site you visit. To the network the traffic looks like ordinary page loading, which makes it much harder to single out and block. Firefox, Chrome, and Edge can speak DoH on their own, so it is the protocol most people end up using without configuring anything.

DNS-over-QUIC (DoQ)

QUIC is a newer, faster way of moving data, built for connections that lose packets: mobile data and crowded Wi-Fi. On an older connection a single lost packet holds up everything queued behind it. QUIC removes that constraint, so your answers keep arriving while a lost one is re-sent.

DoQ carries DNS directly over QUIC, again on port 853. It has the least overhead of the five, with no extra layer between the question and the connection, and it shares DoT’s weak spot of running on a port of its own that a network can close.

DNS-over-HTTP/3 (DoH3)

DoH3 combines the two ideas, sending web-shaped traffic on port 443 and carrying it over QUIC.

DoQ is marginally faster on paper, since it skips the extra web layer. DoH3 trades that small margin for traffic that looks like ordinary web browsing on port 443, which is usually worth it. Firefox and Chrome switch to DoH3 automatically when the resolver supports it.

We serve DoH3 at the same address as DoH, so there is nothing extra to set up. Each reply advertises the faster route, and clients that understand the hint move across on a later connection.

Oblivious DoH (ODoH)

The four protocols above hide your queries from your network. None of them hides anything from the resolver, which still sees your IP address alongside everything you look up. The usual answer to that is to pick a resolver you trust.

ODoH lowers how much trust that takes. Your device encrypts the query so that only we can read it, then sends it through a relay run by somebody else entirely. The relay learns who you are while the query stays unreadable to it, and we read the query while seeing only the relay’s address.

That split holds only while the relay stays independent of us, so you choose one yourself, and your dúndns profile page fills in the settings. The costs are a little speed, from the extra hop, and limited app support, since ODoH is still new.

Which one should you use

All five work on every dúndns profile, which makes this a question about your network conditions. DoH is a safe default if you would rather not think about it, and your browser will move to DoH3 on its own wherever it can.