DNS over TLS and why I run my own resolver
Every time your phone opens a site, it first asks a DNS server for the address. That question is a list of every site you visit. Plain DNS sends it unencrypted over UDP port 53, so your network and your provider can read it.
Three ways to ask
| Name | Port | How it travels |
|---|---|---|
| Plain DNS | 53 | No encryption |
| DNS over TLS (DoT) | 853 | A TLS connection that carries only DNS |
| DNS over HTTPS (DoH) | 443 | DNS inside ordinary HTTPS requests |
DoT and DoH hide the questions from the network. They do not hide them from the resolver itself. You still have to trust whoever runs it.
Why I run the resolver myself
I used a hosted resolver with ad blocking. It worked. But I already rent a VPS, and running the resolver myself means one less company sees my queries. The block lists are mine to change, and I can add a rule in seconds.
The trade-off is that I own the failure. If the resolver dies, my phone stops resolving every name. I treat that as a serious outage, so a timer checks it every two minutes and sends me a message after two failures.
Why port 53 stays closed
A resolver that answers anyone on port 53 is an open resolver. Attackers send it small queries with a forged sender address, and it floods the victim with large answers. This is an amplification attack, and it gets your server blocked.
DoT and DoH need a TLS handshake before any query. A forged sender address cannot finish a handshake, so these ports make poor amplifiers. That is why my resolver publishes 853 and serves DoH through the reverse proxy, but never publishes 53.
How the phone connects
Android has a setting called Private DNS. You enter a hostname, and the phone uses DoT to that host on port 853. The hostname must have a valid certificate. Mine reuses the one the reverse proxy already gets.
Where to go next
- My own DNS resolver for my phone has the config, the block lists, and a latency test.
- Watch a service and get a Telegram alert shows how the two-minute check works.