What is TLS?

The Encryption Protocol Behind HTTPS and DNS-over-TLS

TLS (Transport Layer Security) is the encryption protocol that secures data in transit across the internet. It powers HTTPS for web browsing and DNS-over-TLS (DoT) for encrypted DNS queries.

Learn About DNS Security

Step 1: What is TLS?

TLS (Transport Layer Security) is a cryptographic protocol that provides privacy and data integrity between two communicating applications. It's the successor to SSL (Secure Sockets Layer) and is used to encrypt virtually all internet communications.

When you see the padlock icon in your browser, that's TLS at work — encrypting the connection so that no one between you and the server can read or modify the data.

The current version is TLS 1.3, which simplified the handshake process and removed older, less secure cipher suites. TLS 1.2 is still widely supported, while TLS 1.0 and 1.1 have been deprecated.

Step 2: The TLS Handshake

Before encrypted communication begins, the client and server perform a TLS handshake:

  • Client Hello: The client sends supported TLS versions, cipher suites, and the SNI (server name)
  • Server Hello: The server responds with its chosen cipher suite and TLS certificate
  • Certificate verification: The client verifies the server's certificate against trusted Certificate Authorities
  • Key exchange: Both parties generate shared encryption keys using asymmetric cryptography
  • Encrypted session: All subsequent data is encrypted with the shared keys

TLS 1.3 reduces this to a single round trip, improving performance.

Step 3: TLS in DNS

TLS is used in two key DNS protocols:

  • DNS-over-TLS (DoT): Wraps standard DNS queries in a TLS connection on port 853. Android 9+ supports this natively as "Private DNS." CleanBrowsing fully supports DoT for encrypted DNS filtering
  • DNS-over-HTTPS (DoH): Sends DNS queries inside HTTPS connections (which use TLS). Supported by browsers like Chrome and Firefox

Both protocols use TLS to prevent eavesdropping on DNS queries and protect against DNS hijacking and man-in-the-middle attacks during query transport.

For website owners, TLS also secures the connection between visitors and the website itself. NOC.org provides TLS certificate management, CDN, and WAF services that protect websites on the server side.

Step 4: TLS and DNS Filtering

TLS encrypts data in transit but doesn't prevent DNS filtering. DNS filtering operates at the DNS resolution layer — before any TLS connection is established. When you use CleanBrowsing with DoT or DoH, TLS actually strengthens filtering by:

  • Protecting the DNS query: Third parties can't see or modify your DNS queries in transit
  • Authenticating the resolver: TLS certificates verify you're connected to CleanBrowsing, not a rogue resolver
  • Preventing bypass: Encrypted DNS connections are harder to intercept or redirect than plaintext DNS

Encrypt your DNS with TLS

Learn About DNS Security