What Is DNS over HTTPS (DoH)?
On this page
DNS over HTTPS (DoH) encrypts your DNS queries by sending them inside HTTPS, so that anyone watching the local network or the path — your ISP, a café Wi-Fi operator — cannot see which sites you are resolving or tamper with the answers. It adds the privacy that classic DNS and even DNSSEC lack.
What does DoH protect?#
Traditional DNS queries travel in plaintext, visible to every hop on the path. DoH wraps them in TLS:
| Without DoH | With DoH |
|---|---|
| ISP/network sees every lookup | Lookups hidden from local observers |
| Queries can be tampered in transit | Integrity-protected by TLS |
| Easy to censor by DNS | Harder to block selectively |
DNS over TLS (DoT) achieves the same protection over a dedicated port; DoH blends into normal HTTPS traffic, which makes it harder to single out and block.
What are the trade-offs?#
DoH is not a pure win. It shifts trust to your DoH resolver, who still sees your queries — so you are choosing whom to trust, much like a VPN. It can also complicate enterprise security that relies on inspecting DNS, and it does not prove the answer is authentic — that remains DNSSEC’s job.
DoH is the privacy layer for DNS. More at the Network Security hub.
Frequently asked questions#
What is DNS over HTTPS?
DNS over HTTPS (DoH) sends DNS queries inside encrypted HTTPS connections instead of plaintext. This hides your DNS lookups from anyone observing the local network or path — your ISP, a Wi-Fi snooper — and prevents them from tampering with the queries. DNS over TLS (DoT) achieves the same goal over a dedicated TLS port.
What is the difference between DoH and DNSSEC?
DoH encrypts the query path for privacy and integrity in transit; DNSSEC signs the records for authenticity regardless of path. DoH hides what you look up from local observers but trusts the resolver; DNSSEC proves the answer is genuine but does not hide it. They are complementary, not alternatives.