Using "tls.dnsp.co"

"tls.dnsp.co" tells you whether your query arrived over DNS over TLS, and if it did, reports the details of the handshake.

Ordinary DNS is sent in clear text on port 53. Anyone on the path — the coffee shop, the ISP, anything between — can read every name you look up, and can rewrite the answers. DNS over TLS (RFC 7858) puts the same protocol inside a TLS connection on port 853, so the queries are encrypted and the server is authenticated.

Asked over port 53 this test simply tells you the query was not encrypted. Asked over port 853 it reports the negotiated protocol version, the cipher, and the certificate presented — which is worth checking, because a DoT client that fails to verify the certificate gets no protection against interception at all.

Example over ordinary port 53:

prompt> dig +short tls.dnsp.co TXT
"This query did NOT arrive over TLS. Port 853 (DNS over TLS) reports handshake details here."

Example over DNS over TLS:

prompt> kdig +tls @dnsp.co tls.dnsp.co TXT
"transport=DNS over TLS"
"tls_version=TLSv1.3"
"cipher=TLS_AES_256_GCM_SHA384"