I'm looking for a method to check whether DNS over TLS is blocked in my network by my ISP or not. A method that isn't just trial and error of a bunch of popular DoT providers to see which one connects because I need to know for a fact that my ISP is using a block list or well-known DoT providers or they are using a technique (if any?) to block all DoT connections entirely.

I've tried lots of DoTs but none of them work on my Internet, DoH works though, most likely because it uses the same port 443 as the rest of the HTTPS web traffic.

Is there a fundamental method to use to find out which protocols, such as DoT, VPN protocols etc. are being blocked in a network by the ISP, administrator etc.?

  • 1
    Did you try asking them?
    – schroeder
    Commented Jul 1, 2022 at 12:21
  • Unfortunately that's not an option.
    – user279925
    Commented Jul 1, 2022 at 12:22
  • 2
    Setup your own listener with openssl s_server ... on port 853 on an external system in your control - which is not a well known as DoT endpoint. Try to connect to it with openssl s_client .... If TLS handshake works then it is not blocked based on well-known DoT endpoints. Commented Jul 1, 2022 at 12:39
  • FWIW: DoH is HTTPS is Port 443, also you can use a few other tools to 'ping' ports per guidance here: devconnected.com/how-to-ping-specific-port-number
    – Ed Daniel
    Commented Jul 1, 2022 at 12:57
  • 2
    Depends on what you see on the network. If you always see a TCP RST when trying to connect to arbitrary IP port 853 then this port is blocked. If the connection attempt just times out you don't know if the packets are blocked by the ISP or if there simply is no server to respond at this IP. Commented Jul 1, 2022 at 13:33

1 Answer 1


Fundamentally you just try to connect using a particular protocol, run queries and check the results but that all will be protocol specific. There's no one utility which will do it automatically for you.

Deep packet inspection devices and firewalls work differently and may exhibit different behavior.

You must log in to answer this question.