Port 443 Doesn't Turn dig into a DNSCrypt Client

dig @resolver.example -p 443 +tcp sends a DNS query over TCP to port 443. It does not negotiate DNSCrypt.

That matters when modifying a proxy DNS helper to use an encrypted resolver. A service can listen on a familiar port while expecting a completely different wire format.

Use a DNSCrypt-aware resolver component for the encrypted upstream conversation. If it exposes a local plain-DNS interface, a conventional DNS helper can query that interface using its documented address and port.

Keep both hops explicit: helper to local resolver, then resolver to upstream. The first hop working does not establish that the second follows the intended proxy route.

The same distinction applies to DNS over HTTPS and DNS over TLS. Changing a port number in dig is not a protocol adapter. For a different, HTTP-based interface, use an HTTPS JSON query to Google Public DNS. Check the endpoint's contract before interpreting a timeout as another broken SOCKS server.