Why Encrypt DNS
Protect DNS questions from casual observation in transit
Classic DNS usually sends the question and answer in plaintext. A network operator between the device and resolver can observe, block or alter that traffic.
What encryption changes
DoH, DoT and DoQ authenticate the configured resolver and encrypt DNS traffic between the client and that resolver:
- DoH uses HTTPS, normally on TCP or QUIC port 443.
- DoT uses TLS on TCP port 853.
- DoQ uses QUIC. le_dns publishes it on UDP port 8853.
Encryption does not hide the resolver’s IP address, prevent the resolver from processing the question, anonymize other network traffic or replace DNSSEC validation.
Choosing a transport
DoH is widely supported by browsers and can work on networks that block dedicated DNS ports. It is not impossible to identify or block: policy controls and known endpoint addresses still exist.
DoT has a clear, dedicated port and a simple hostname-authentication model. Networks can block port 853 without affecting ordinary HTTPS.
DoQ can reduce connection setup overhead and handle packet loss differently from TCP. Actual performance depends on the client and network; it is not universally the fastest option. The le_dns v2 server disables 0-RTT.
le_dns endpoints
- DoH:
https://website-xnqsyvgcprzaash17upkc5cd.DE-FRA-COG.ledns.infra.rqsco.cloud/dns-query - DoT:
ledns.eu:853 - DoQ:
ledns.eu:8853over UDP
DoH over HTTP/3 uses the same HTTPS URI when negotiated. h3:// is not a separate resolver URI. dnscrypt-proxy is not a DoQ client.
Privacy boundary
Encryption moves trust from the local network to the selected resolver. At the last verified production snapshot on 2026-08-29, le_dns still used the legacy stack. That dated evidence is not proof of current live state; reverify the deployed service before making a current claim. The v2 RAM-only aggregation boundary must not be presented as deployed. The conservative disclosure is in the Privacy Policy.