What is the difference between Cloudflare's DNS over TLS (DoT) and DNS over HTTPS (DoH)?

Both Cloudflare's DNS over TLS (DoT) and DNS over HTTPS (DoH) encrypt DNS queries, but they use different underlying protocols. DoT uses the TLS protocol directly over a dedicated port (TCP 853), making it explicitly a DNS service. DoH, on the other hand, encapsulates DNS queries within the HTTPS protocol, typically over TCP port 443, the same port used for regular web traffic. This can make DoH harder to block or differentiate from regular web traffic, offering a degree of obfuscation, while DoT provides direct, dedicated encryption for DNS.