AZTCOFW / TECHNICAL GUIDE
DNS over TLS
Another concern is that clients could use DNS over TLS to resolve hosts. DNS over TLS sends DNS requests over an encrypted channel on an alternate port, 853.
This traffic can be blocked with a firewall rule for port 853 using the same procedure used for 53. Though if the firewall will not be providing DNS over TLS service to clients, do not add the pass rule.
Imported from the AZTCOFW knowledge base on 2026-09-05. Historical guidance may refer to older software versions. Confirm applicability before changing a production system.
Original source ↗