DNS over HTTPS
Also known as: DoH, DoT, DNS over TLS, Oblivious DoH, ODoH, encrypted DNS
DNS over HTTPS (DoH) sends DNS queries over encrypted HTTPS connections instead of plaintext UDP.
Traditional DNS is unencrypted -- your ISP, network provider, or anyone on the network can see every domain name you look up. DoH hides this traffic within normal HTTPS, improving privacy and making DNS harder to censor or manipulate.
DNS over HTTPS, explained at three levels
At home
When you type a website address, your device asks a DNS server what IP address that website uses. Traditional DNS asks this question in plain view of your ISP and anyone on the network. DoH encrypts that question so only you and the DNS resolver (like Cloudflare or Google) can see it.
At work
DoH changes where DNS filtering and monitoring happens. Corporate networks typically rely on DNS monitoring to block malicious sites and track usage. When employees use DoH in browsers, those DNS queries bypass corporate DNS servers -- a security and compliance consideration for IT teams.
At home
Standard DNS uses UDP port 53 in plaintext. DoH uses HTTPS port 443 (same as regular web traffic), encrypted with TLS. Popular DoH providers: Cloudflare (1.1.1.1), Google (8.8.8.8), and NextDNS (customizable filtering). DoT (DNS over TLS, RFC 7858) is an alternative using TLS on port 853 without HTTP wrapping -- more transparent but easier to block.
At work
Enterprise policy considerations: DoH can be configured to use a company's own DoH-capable resolver, maintaining network DNS monitoring while gaining encryption. MDM (Mobile Device Management) profiles and group policies can enforce specific DoH resolvers or disable DoH on managed devices. IETF RFC 8499 and NCSC guidance address enterprise deployment patterns.
At home
DoH doesn't provide complete privacy: the IP address you connect to is still visible (and IP-to-domain mapping is often obvious for major sites), and the TLS SNI (Server Name Indication) field in HTTPS connections still exposes the destination domain unless ECH (Encrypted Client Hello) is also enabled. DoH is one layer of a privacy stack, not a complete solution.
At work
DoH's HTTPS transport means queries blend with regular web traffic -- DPI (Deep Packet Inspection) cannot distinguish DoH from HTTPS without inspecting the content (which requires TLS interception). This is why DoH disrupts traditional DNS-based security products. Oblivious DoH (ODoH, RFC 9230) adds an additional privacy layer: a proxy relays encrypted DoH queries to the resolver, hiding the client's IP address from the resolver itself.
Real-world examples
At home
Marcus enabled Cloudflare's DoH in his browser settings. Now his ISP can no longer see which websites he's researching -- they only see HTTPS traffic to Cloudflare's servers, indistinguishable from other encrypted web traffic.
At work
Nadia's IT security team configured their enterprise browsers via group policy to use the company's own DoH resolver. Employees get encrypted DNS (protection from public network eavesdropping) while the company maintains DNS logging for security monitoring and block list enforcement.
Common confusions
- DoH makes you completely anonymous online — DoH encrypts DNS queries but doesn't hide your IP address, your HTTPS connection metadata, or your actual web traffic content. It's one privacy improvement among many -- not a substitute for VPN or Tor for full anonymity.
- DoH breaks corporate DNS filtering — DoH breaks DNS filtering only when using external resolvers. Enterprises can mandate their own DoH resolver via policy, maintaining filtering while gaining encryption. The browser respects configured DoH settings in managed environments.
For analysts
DoH adoption affects web analytics and security monitoring tools that relied on DNS queries for visibility. BAs working with security teams should understand why DoH changes the threat detection landscape and what compensating controls are needed.
History & origin
DoH was standardized as RFC 8484 in October 2018. Mozilla enabled DoH by default in Firefox for US users in 2020, triggering significant industry debate -- ISPs could no longer monitor or filter DNS traffic for their own users. Google Chrome followed with DoH adoption. Enterprise network administrators pushed back because DoH bypasses network-level DNS filtering and monitoring. The debate highlighted the tension between user privacy and network operator control.