Definition
DNS over TLS, defined in RFC 7858, encrypts DNS queries by wrapping them in a TLS session. Unlike DoH, DoT uses a dedicated port (853) and is therefore identifiable as DNS traffic on the wire — but the contents are protected from inspection or modification. DoT is favoured at the system or network level because it is cleaner to implement and easier to monitor and audit; DoH is favoured at the application level (especially in browsers) because it is harder to block.
Use Cases
Android since version 9 ('Pie') supports DoT system-wide as 'Private DNS.' Most Linux DNS resolvers (systemd-resolved, dnsmasq, Unbound) support DoT. Network operators who want to enforce a policy of encrypted DNS on a whole network typically deploy DoT, because they can see that DNS traffic is happening (and route it through their preferred resolver) without seeing the contents of individual queries.
VPN Considerations
Like DoH, DoT can leak queries outside the VPN tunnel if not configured carefully. Most VPN clients route DoT through the tunnel and have the tunnel's exit point use the provider's resolver. The double-wrapping (DoT inside the VPN tunnel) is redundant but harmless and provides defence in depth.