DNS over HTTPS and DNS over TLS

Traditional DNS messages are commonly sent without encryption. A network observer between a client and its resolver can read the queried names, and an active attacker on that path may be able to interfere with responses.

Two standardized transports protect this part of DNS:

Both provide confidentiality and integrity for DNS traffic between a client and an encrypted DNS resolver. When the resolver is authenticated correctly, they also protect the client from being silently redirected to an impostor resolver.

They do not make DNS anonymous, and they do not automatically encrypt every later query between the recursive resolver and authoritative servers. The exact protection depends on where the encrypted connection begins and ends.