What is DNS over HTTPS (DoH)?
DNS over HTTPS (DoH) is a protocol that encrypts DNS queries by sending them inside normal HTTPS traffic. Traditional DNS sends queries in plain text over UDP port 53, meaning anyone between you and the DNS resolver — your ISP, a coffee shop's Wi-Fi operator, or a government — can see every domain you look up. DoH eliminates this visibility by wrapping DNS inside TLS-encrypted HTTP/2 or HTTP/3, making it indistinguishable from ordinary web traffic.
DoH is defined in RFC 8484 (2018). It operates on TCP port 443, the same port used for HTTPS, and uses standard HTTP methods — typically GET with a base64url-encoded query parameter, or POST with a binary DNS wire-format body.
How Traditional DNS Exposes You
When you type any domain into your browser, your device sends a DNS query before any connection to the destination is made. This query travels as a plain UDP packet to port 53 and contains the full domain name in cleartext. Every router, ISP peering point, and network monitoring appliance along the path can read it.
In practice, this means:
- Your ISP knows every domain you visit, even for HTTPS sites where the content itself is encrypted
- DNS responses can be forged — a technique called DNS hijacking — redirecting you to malicious servers
- Governments and network operators use DNS blocking as a censorship mechanism
- Advertisers and analytics companies build browsing profiles from DNS logs
Even with a VPN, if DNS queries escape the tunnel (a common misconfiguration called a DNS leak), your browsing pattern is exposed.
How DoH Works
DoH replaces the plaintext UDP query with an HTTPS request to a DoH resolver endpoint. For example, Cloudflare's resolver accepts queries at https://cloudflare-dns.com/dns-query. A GET request looks like:
GET /dns-query?dns=AAABAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB HTTP/2
Host: cloudflare-dns.com
Accept: application/dns-messageThe base64url-encoded parameter is a standard DNS wire-format message. The server responds with Content-Type: application/dns-message and the binary DNS response, all inside TLS. The TLS handshake authenticates the resolver using its X.509 certificate, preventing tampering with both queries and responses.
DoH vs DNS over TLS (DoT)
DNS over TLS (DoT), defined in RFC 7858, is a closely related protocol that also encrypts DNS but uses a dedicated port — 853 — with TLS applied directly to the DNS wire format rather than wrapping it in HTTP.
| Feature | DoH (RFC 8484) | DoT (RFC 7858) |
|---|---|---|
| Port | 443 (HTTPS) | 853 |
| Transport | HTTP/2 or HTTP/3 over TLS | TLS directly |
| Blockability | Hard — blends with web traffic | Easy — dedicated port |
| Visibility to network | Looks like HTTPS to any observer | Identifiable as encrypted DNS |
| Typical use | Browsers (Firefox, Chrome) | OS-level resolvers, Android |
The choice between them depends on context. DoT on port 853 is easier for network administrators to manage — they can see and selectively allow or block encrypted DNS traffic. DoH is preferred in situations where censorship-resistant browsing matters, since blocking port 443 would break all HTTPS, which is generally unacceptable.
A third option — DNS over QUIC (DoQ), RFC 9250 — uses QUIC as the transport, offering lower latency than DoT and the same privacy guarantees. See how DNS over QUIC works.
Browser-Level vs. System-Level DoH
DoH can be deployed at two levels:
- Browser-level — Firefox and Chrome implement DoH independently of the operating system. When enabled, the browser sends all its DNS queries directly to a configured DoH resolver, bypassing the OS resolver and any network-supplied DNS. Firefox calls this "Trusted Recursive Resolver" (TRR). This means the browser's DNS traffic is encrypted even if the rest of the system is using plaintext DNS.
- System-level — Windows 11, Android 9+, and recent macOS versions support DoH or DoT natively. When configured at the OS level, all applications benefit from encrypted DNS, not just browsers.
Privacy Tradeoffs and Trust
DoH improves privacy against network-level observers but shifts DNS visibility to the DoH resolver operator. When you use Cloudflare's 1.1.1.1 DoH service, Cloudflare learns which domains you query. Your ISP no longer can, but Cloudflare can.
The key questions are:
- Does the resolver operator log queries, and for how long?
- Are they subject to legal process that could compel disclosure?
- Do they operate as a neutral resolver or use the data for advertising?
Major DoH providers (Cloudflare, Google, Quad9, NextDNS) publish privacy policies and in some cases submit to independent audits. Cloudflare commits to not selling DNS data and purging logs within 25 hours. For organizations that want full control, running a private DoH resolver eliminates the third-party trust question entirely.
DoH and Encrypted Client Hello (ECH)
Even with DoH, one piece of information leaks: the TLS Server Name Indication (SNI) field in the initial TLS handshake reveals the hostname of the server being connected to. An observer who cannot read DNS queries can still see SNI. Encrypted Client Hello (ECH) addresses this by encrypting the SNI in the ClientHello message, and ECH relies on DNS to distribute the encryption keys — making secure DNS (via DoH or DoT) a prerequisite for ECH to work end-to-end.
DoH and BGP
DoH resolvers are reachable via standard IP addresses and their traffic is routed through BGP like any other internet traffic. Both Cloudflare and Google deploy their DoH resolvers via anycast, so your queries go to the nearest physical data center. A BGP hijack targeting a resolver's address could redirect your encrypted DNS queries — underscoring why RPKI validation and resolver authentication via TLS certificates both matter.