You've probably heard that browsing the internet isn't as private as it seems. The reality is that, by default, the DNS system , which translates website names into IP addresses, works without any encryption, sending information in plain text. This leaves the door open for malicious actors, or even your own internet service provider, to see which pages you visit or, worse, redirect you to fake sites through cache poisoning attacks.
To combat this, protocols like DNS over TLS (DoT) and DNS over HTTPS (DoH) have emerged. These technologies act as a shield, encrypting requests so that no one can intercept them along the way. Depending on whether you have ASUS or TP-Link equipment, or use custom firmware, the process varies, but the goal is the same: to protect your privacy from the very core of your home network.
What is the difference between DoT and DoH?
Although both serve the same purpose, they take different paths. DNS over TLS (DoT) uses a dedicated channel, specifically port 853. It's a very robust and standardized option, promoted by the IETF, which ensures a secure connection before any data is sent. However, because it uses a dedicated port, some firewalls might block it, causing browsing to fail if it's not configured correctly.
On the other hand, we have DNS over HTTPS (DoH) . This is a bit more cunning, as it embeds DNS queries within normal HTTPS traffic, using port 443. To an outside observer, it's impossible to distinguish a DNS request from a visit to a regular website. This makes it very difficult to block, although some network administrators don't like it because they lose control over their infrastructure's traffic.
Operating modes: Strict vs. Opportunistic
When you configure these protocols on your router, you'll likely encounter two security options. Strict mode is the most restrictive: if the router can't verify the DNS server's identity using digital certificates, it simply cuts off the connection. This is the ideal option if you don't want to take any risks, although it means that if the server fails, you'll be without internet until the problem is resolved.
If you'd rather avoid interruptions, opportunistic mode is your best bet. In this mode, the router will attempt to use the encrypted connection, but if authentication fails for any reason, it will automatically revert to the traditional, unencrypted DNS. Essentially, it prioritizes website loading over complete privacy, thus preventing name resolution from stopping entirely.
Step-by-step guide for ASUS routers
If you have an ASUS router, the first thing you should do is check that your firmware is up to date, as these features usually require versions later than 3.0.0.4.386.4xxxx . Once a day, log in to the web interface (usually via http://www.asusrouter.com) with your credentials.
- Go to the menu WAN and then to Internet Connection.
- Look for the DNS Privacy Protocol option and select DNS over TLS (DoT).
- Use the server dropdown to choose compatible providers such as Google, Cloudflare, or Quad9.
- Click Add and save the changes.
If you're using Asuswrt Merlin firmware , the process is similar but you have more flexibility. You can enable DNSSEC simultaneously to add an extra layer of validation. An important tip is to configure at least two or three different DNS servers to prevent the network from going down if one of them stops responding.
Configuration on TP-Link devices
On TP-Link devices, support varies depending on the model range. While the latest AX series models support both DoH and DoT, some AC series models only support DoH. To configure it, log into the administration panel and go to Advanced, Network, and then Internet.
There you can choose between DNS privacy settings in "None", DoT, or DoH mode. TP-Link offers a very useful button called Detect DNS Server , which checks in real time whether your chosen servers are operational before applying the settings. You can choose between the default mode or Ultra Secure mode , which is equivalent to the strict mode mentioned earlier.
Advantages and possible disadvantages
Implementing these technologies brings clear benefits, such as preventing Man-in-the-Middle attacks and eliminating ISP spying . Furthermore, setup is relatively simple for any user with basic knowledge who wants to improve their digital security.
However, it's not all perfect. You might notice a slight increase in latency , as the encryption and decryption process takes a little longer than conventional DNS. Additionally, if you configure strict mode and the DNS server has a problem with its certificates, you could experience loading errors on all your web pages.
Encrypting DNS queries is a crucial step for anyone wanting to regain control over their online data. Whether you choose the discretion of port 443 with DoH or the robustness of port 853 with DoT, the result is a connection far more resistant to intrusions and browsing where your search history is no longer an open book for third parties.