Free

DNS endpoint tester

Q: How do I test a DoH endpoint?

Enter the hostname, or the full URL such as https://dns.example.com/dns-query, and run the test. If you give only a hostname the path /dns-query is used. The tester sends real DNS queries over HTTPS using both POST and GET and reports the TLS, HTTP and DNS results.

Q: What is the difference between DoT and DoH?

DNS-over-TLS uses a dedicated port, 853. DNS-over-HTTPS uses port 443 and looks like ordinary web traffic. DoT is easier for a network to identify and block, DoH is easier to run behind an existing web server.

Q: Why is the DNSSEC result inconclusive?

The test asks for two domains run by a third party, one with a valid signature and one with a deliberately broken one. If either lookup fails or returns something unexpected, the result cannot be called pass or fail.

Q: Does the ad filtering check pass or fail a server?

Neither. It is informational. It looks up doubleclick.net and reports whether the answer was blocked, so you can see if a filter is active.

A full check of a DNS-over-TLS or DNS-over-HTTPS endpoint: every address, TLS versions and certificate, HTTP/2, DNS answers, DNSSEC, ad filtering and privacy features.

Last reviewed October 2026

What does this DoH and DoT tester check?

It connects to your DNS server the way a real client would: it opens a TLS connection, validates the certificate, then sends live DNS queries and inspects the answers. DoT is tested on port 853 and DoH on port 443.

Check	What the tester does	Pass means
Hostname	Resolves the name and tries every address (up to six).	All addresses accept connections. A failing IPv6 address often only means the tester has no IPv6.
TLS versions	Attempts separate handshakes limited to TLS 1.3, 1.2 and 1.0/1.1.	1.3 offered, 1.0 and 1.1 refused. Warns if only 1.2 is offered.
Certificate	Validates the chain and hostname against public roots, and lists names, key type, expiry and OCSP stapling.	Trusted for this hostname. Warns when it expires in under 14 days.
HTTP/2 (DoH)	Checks which HTTP version was negotiated.	HTTP/2 negotiated. HTTP/1.1 only gets a warning.
DNS answers	Queries example.com three times and records each response time.	A real answer comes back. Timings are measured from our server, not your device.
GET and POST (DoH)	Sends the same query both ways, as RFC 8484 allows.	Both work. Some clients only use GET.
DNSSEC	Looks up one correctly signed and one deliberately broken test domain.	The signed one returns the AD flag and the broken one returns SERVFAIL.
Non-existent names	Asks for a random name that cannot exist.	NXDOMAIN. Fails if the server invents an address (NXDOMAIN redirection).
QNAME minimisation	Queries a test name from internet.nl that reveals the behaviour.	Upstream servers only see the part of the name they need (RFC 9156). Informational.
EDNS padding	Asks for a padded reply.	Padded (RFC 7830), so reply size leaks less about the name. Informational.
IPv6 answers	Asks for the AAAA record of example.com.	An IPv6 address is returned.
Discovery (DDR)	Reads `_dns.resolver.arpa`.	Informational: lists the encrypted endpoints the server advertises.
Ad filtering	Looks up doubleclick.net.	Informational: shows whether a blocklist is active.

What is the difference between DoT and DoH?

DoT wraps DNS in TLS on its own port (853). DoH sends DNS inside HTTPS on port 443. The privacy is the same; the difference is how they behave on a network.

	DNS-over-TLS (DoT)	DNS-over-HTTPS (DoH)
Port	853	443
Standard	RFC 7858	RFC 8484
Visible on the network	Yes, easy to spot and block	Blends with normal HTTPS
Typical use	Android Private DNS, routers, resolvers	Browsers, apps, anywhere port 853 is blocked
Needs a path	No	Yes, usually `/dns-query`

Common problems and how to fix them

HTTP 404, 400 or 405 on DoH

The path is wrong. Use the exact URL your provider gave you. When the path fails, the tester tries /dns-query, /dns, /query, /doh, /resolve and / and tells you which one answers.

Certificate not trusted

Usually a missing intermediate certificate (serve the full chain), a certificate issued for a different hostname, or an expired one. Clients validate the name you connect with, so the certificate must list it.

Connection refused or timed out on DoT

Nothing is listening on 853, or a firewall drops it. Check that the service is bound to a public address and that the port is open inbound.

Still accepts TLS 1.0 or 1.1

Both were deprecated by RFC 8996. Set the minimum version to TLS 1.2 in your server or proxy, and offer 1.3 if you can.

What this tester cannot tell you

It only tests ports 853 and 443, and hostnames only: IP addresses and private ranges are refused. It does not open QUIC connections, so DNS-over-QUIC and HTTP/3 are not tested; it reports whether HTTP/3 is advertised. Response times come from the tester's server, so they show how fast the endpoint answers, not how fast it is for you. DNSSEC and QNAME minimisation use test names run by third parties, which is why those can come back inconclusive.

Frequently asked questions

How do I test a DoH endpoint?

Enter the hostname, or the full URL such as https://dns.example.com/dns-query, and run the test. With only a hostname, /dns-query is used. The tester sends real queries over HTTPS using POST and GET.

What is the difference between DoT and DoH?

DoT uses port 853 and is easy for a network to identify and block. DoH uses port 443 and looks like web traffic. See the table above.

Why is the DNSSEC result inconclusive?

The test needs two third-party domains, one validly signed and one broken on purpose. If either lookup fails or returns something unexpected, the result cannot be called pass or fail. Try again, or test against a resolver you know validates.

Does the ad filtering check pass or fail a server?

No. It is informational. It shows whether doubleclick.net was blocked, so you can see if a filter is active.

Want your own private DNS endpoint? Pi-hole or AdGuard Home with Unbound, encrypted DoT/DoH, no hardware.

See NxValue Stack →