Hack the Route Start free Open app Names and DNS
Encrypted DNS
DNS questions sent inside TLS (DoT, port 853) or HTTPS (DoH, port 443), so the path cannot read or change them.
Plain DNS crosses the network in the clear: anyone on the path can log or forge it. DoT wraps it in TLS on its own port, 853, easy to spot and block; DoH puts it in HTTPS requests on 443, mixed with web traffic. The client checks the resolver's certificate. The resolver itself still sees every question.