DNS Over HTTPS: What It Is & How It Works

DNS over HTTPS (DoH) is a protocol that encrypts the domain name system (DNS) queries your device sends to a resolver, wrapping them in the same HTTPS encryption used by secure websites. Instead of sending your lookups in plain text where anyone on the network can read or tamper with them, DoH hides them inside normal web traffic. This article explains how DoH works, why it matters, how to enable it, and what its limitations are.

Background: Why DNS Was Never Private

The Domain Name System is the internet’s phone book. When you type a website address, your device sends a DNS query to a resolver (often run by your internet service provider) asking for the IP address of that domain. For decades, those queries were sent in plain text over UDP or TCP port 53. That means anyone who can see your network traffic—your ISP, a Wi-Fi hotspot operator, a malicious actor on the same network—can see every domain you look up. They can also modify the response, redirecting you to a fake site (DNS spoofing or cache poisoning).

DNS over HTTPS was developed to fix these problems. The idea is simple: use the same encryption that protects your banking session to protect your DNS lookups. The protocol was standardized in RFC 8484 in 2018, and since then major browsers and operating systems have added support.

How DNS Over HTTPS Works

Instead of sending a raw DNS packet to a resolver on port 53, DoH sends an HTTP request to a special URL on an HTTPS server. The query is encoded in the URL or in the request body, and the response comes back as JSON or as a binary DNS message. Because the traffic is over HTTPS, it uses port 443 and is indistinguishable from normal web traffic to a network observer.

The key steps are:

• Your device or browser is configured with a DoH server URL, such as https://cloudflare-dns.com/dns-query or https://dns.google/dns-query.
• When you request a domain, the client sends an encrypted HTTPS request to that URL.
• The DoH server looks up the IP address and returns it in an encrypted HTTPS response.
• Your device then connects to that IP address normally.

Because the query is inside an HTTPS connection, the only thing a network observer sees is that you are connecting to the DoH server’s IP address. They cannot see which domains you are asking about, and they cannot modify the response without breaking the TLS certificate.

How to Enable DNS Over HTTPS

You can turn on DoH at different levels, depending on what you want to protect.

• Browser-level: Most modern browsers (Chrome, Firefox, Edge, Safari) have a setting to enable DoH. This only protects queries made from that browser, not from other apps on your device.
• Operating system-level: Windows 11, macOS, Android, and iOS all have options to configure a secure DNS resolver system-wide. This covers all applications, not just the browser.
• Router-level: Some routers let you set a DoH upstream for the whole home network. This is more complex and not all routers support it.

To enable it in a browser, look for “DNS over HTTPS” or “Secure DNS” in the privacy or security settings. On Windows 11, go to Settings > Network & Internet > Wi-Fi (or Ethernet) > Hardware properties, then click Edit next to DNS server assignment and choose a DoH provider. On Android, go to Settings > Network & Internet > Private DNS. On iOS, go to Settings > General > VPN & Device Management > DNS.

If you want to use a specific provider, you need to enter its DoH URL or hostname. Some common ones are:

• Cloudflare: cloudflare-dns.com (or 1.1.1.1)
• Google: dns.google (or 8.8.8.8)
• Quad9: dns.quad9.net

Common Problems and Misconceptions

One common misconception is that DoH makes you anonymous. It does not. The DoH server sees all your queries, and if it logs them, it knows your browsing history. Your ISP no longer sees the domain names, but the DoH provider does. You are simply shifting trust from one party to another.

Another issue is that DoH can break network-level content filtering. Parental controls, corporate security policies, and some ISP-level blocking rely on seeing DNS queries. When you use DoH, those filters are bypassed. This has led some organizations to block DoH traffic entirely, which can cause DoH to fail silently and fall back to plain DNS.

Performance is sometimes a concern. DoH adds an extra HTTP round trip, and the encryption/decryption takes a tiny bit of CPU. In practice, the difference is usually negligible, especially with HTTP/2 or HTTP/3 multiplexing. Some users report DoH being faster because the resolver may have better routing than their ISP’s DNS.

Another misconception is that DoH protects you from malware or phishing. It does not. It only encrypts the query; it does not filter the results. If you want blocking, you need a DoH service that also filters (like Quad9 or Cloudflare for Families).

DNS Over HTTPS vs. DNS Over TLS

DNS over TLS (DoT) is the other main encrypted DNS protocol. Instead of using HTTPS, DoT uses a dedicated TLS connection on port 853. The key difference is that DoT has a distinctive port, so network administrators can easily block it. DoH uses port 443, the same as normal web traffic, making it much harder to block without breaking the web.

Both provide the same encryption and integrity guarantees. DoT is simpler and slightly lower overhead, but DoH is more firewall-evasion friendly. Many providers offer both, so the choice often comes down to whether you want to be able to block it (DoT) or not (DoH).

Is DNS Over HTTPS Safe?

DoH is safe to use in the sense that it uses standard, widely deployed encryption (TLS). The main safety considerations are about trust and compatibility, not cryptography.

• Trust: You must trust the DoH provider to not log or misuse your queries. Choose a provider with a clear privacy policy.
• Compatibility: Some older networks or enterprise environments may not work well with DoH. If you experience issues, you may need to disable it.
• Security: DoH does not protect you from malware or phishing. It only encrypts the query. Use a filtering DoH service if you want that.

It is also worth noting that DoH does not hide the IP address you ultimately connect to. The network observer sees the connection to the website’s IP, which may reveal the site anyway. For example, if you look up example.com and then connect to its IP, the observer can match that IP to the site using a reverse DNS lookup.

Frequently Asked Questions

Does DNS over HTTPS slow down my internet?

Usually not noticeably. The extra overhead is small, and many DoH providers have fast, well-connected servers. In some cases, DoH can even be faster than your ISP’s DNS because the provider may have better infrastructure. If you notice a slowdown, try a different provider.

Can my ISP still see what websites I visit if I use DoH?

Your ISP can no longer see the domain names in your DNS queries, but it can still see the IP addresses you connect to. Since many websites share IP addresses (via hosting services), the ISP may not always know the exact domain, but it can often guess. Also, the ISP sees the connection to the DoH server itself. To fully hide your browsing, you would need a VPN or Tor.

Does DoH work with all websites?

Yes, DoH is independent of the website you are visiting. It only resolves the domain name to an IP address. After that, your device connects to the website normally, whether it uses HTTP or HTTPS.

How do I know if DNS over HTTPS is working?

You can check your browser’s security settings, or use an online tool that shows your DNS resolver. Many DoH providers have a status page (e.g., Cloudflare’s 1.1.1.1/help) that confirms whether you are using their service. On Windows, you can use nslookup to see the resolver address, but that may not show DoH specifically.

Is DNS over HTTPS legal?

Yes, DoH is a standard protocol and is legal in most countries. However, some countries or organizations may block it for censorship or security reasons. Using DoH is not illegal, but circumventing government censorship may be restricted in some jurisdictions.

Can I use DoH on my phone?

Yes, both Android and iOS have built-in support for private DNS (DoH). On Android, go to Settings > Network & Internet > Private DNS. On iOS, you can install a DNS profile or use a third-party app. Many VPN apps also offer DoH as a feature.

Related

• Zombie Rush Best Classes & Costs
• Parse SMS Transactions Without Trusting Regex Alone
• Bosch SMS2ITW01A Features & Ratings Explained