tls.dnsp.co

Whether your query arrived encrypted.

What it does

Asked over port 853 this reports the DNS over TLS connection that carried your query: protocol version, cipher and the certificate we presented. Asked over port 53 it simply tells you the query arrived in the clear.

Example

$ kdig +tls @dnsp.co tls.dnsp.co TXT +short

"tls1.3 TLS_AES_256_GCM_SHA384"

Reading the answer

plaintext on port 53

Expected. Anything on the path can read and rewrite this query.

TLS details on 853

The query arrived encrypted and unread.

an unexpected certificate

The connection was terminated by someone other than us.

Notes

dig supports +tls in recent versions. kdig and dog handle it more reliably.
Encryption hides the query from the path, not from your resolver.