diff --git a/_includes/sections/dns.html b/_includes/sections/dns.html
index 0b802dc9..9930c910 100644
--- a/_includes/sections/dns.html
+++ b/_includes/sections/dns.html
@@ -408,7 +408,11 @@ github="https://github.com/jedisct1/dnscrypt-proxy"
Terms
- - DNS-over-TLS (DoT) - A security protocol for encrypted DNS on a dedicated port 853. Some providers support port 443 which generally works everywhere while port 853 is often blocked by restrictive firewalls.
+ - DNS-over-TLS (DoT) - A security protocol for encrypted DNS on a dedicated port 853. Some providers support port 443 which generally works everywhere while port 853 is often blocked by restrictive firewalls. DoT has two modes:
+
+ - Oppurtunistic mode: the client attempts to form a DNS-over-TLS connection to the server on port 853 without performing certificate validation. If it fails, it will use unencrypted DNS.
+ - Strict mode: the client connects to a specific hostname and performs certificate validation for it. If it fails, no DNS queries are made until it succeeds.
+
- DNS-over-HTTPS (DoH) - Similar to DoT, but uses HTTPS instead, being indistinguishable from "normal" HTTPS traffic on port 443.
- DNSCrypt - An older yet robust method of encrypting DNS.
@@ -444,6 +448,9 @@ github="https://github.com/jedisct1/dnscrypt-proxy"
Encrypted DNS clients for mobile: