> ## Documentation Index
> Fetch the complete documentation index at: https://e-gurl.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# DoH/DoT Proxy

> Run a local DNS proxy with DoH or DoT encryption

# DoH/DoT Proxy

Starting with v3.0.0, DNS-MNS can run a local DoH (DNS over HTTPS) or DoT (DNS over TLS) proxy alongside the existing DNSCrypt proxy.

## What It Does

The proxy listens on a local address (e.g., `127.0.0.1:53`) and transparently encrypts all DNS queries before forwarding them to the upstream provider. Your applications don't need any special configuration - they just talk to the local DNS as usual.

## Protocols

### DoH (DNS over HTTPS)

* Uses HTTPS (port 443) to encrypt DNS queries
* Looks like regular web traffic, making it harder to detect or block
* Works through most firewalls and proxies
* Best choice when DNS traffic is being filtered

### DoT (DNS over TLS)

* Uses TLS on port 853 to encrypt DNS queries
* Dedicated protocol with lower overhead than DoH
* If port 853 is blocked, the proxy automatically falls back to port 443

## Using the Proxy

### Interactive Mode

From the main menu, select option **\[8] DoH/DoT Proxy**:

1. Choose the protocol: DoH or DoT
2. Select a provider from the list (Cloudflare, Google, Quad9, etc.)
3. Enter the listen address (default: `127.0.0.1:53`)
4. The proxy starts and runs until you stop it

### Running Alongside DNSCrypt

Both DNSCrypt and DoH/DoT proxies can run simultaneously on different ports:

```
DNSCrypt Proxy: 127.0.0.1:53
DoH Proxy:      127.0.0.1:5353
```

## Supported Providers

The proxy supports all 28+ DoH/DoT providers built into DNS-MNS, including:

* **International**: Cloudflare, Google, Quad9, AdGuard, Mullvad, ControlD, DNS.SB
* **Regional**: Shecan, Electro, RadarGame, 403Online
* **Privacy**: Mullvad, NextDNS, RethinkDNS, DNS0-EU

## Port Requirements

* Port 53 requires administrator/root privileges
* Use a higher port (e.g., 5353) if you don't have admin access
* Then configure your system DNS to point to `127.0.0.1:5353`

## Privacy Features

* **EDNS Padding (RFC 8467):** All queries are padded to uniform 128-byte blocks to prevent traffic analysis
* **Connection Pooling:** HTTP connections are reused for DoH queries, reducing latency on subsequent lookups

## DPI Evasion

When starting the proxy from the interactive menu, you can enable **TLS fragmentation** to bypass Iran's DPI:

1. **SNI-targeted** — Split at the SNI boundary (recommended)
2. **Random (NoDPI-style)** — Randomized split point and delay

See the [DPI Evasion](/usage/dpi-evasion) page for more details on fragmentation modes.

## Troubleshooting

**"Permission denied" error:**
Run DNS-MNS with `sudo` or use a port above 1024.

**"Address already in use":**
Another DNS service is using the port. Try a different port or stop the conflicting service.