DoH

DoH (DNS over HTTPS, RFC 8484) is a protocol that transports DNS queries and responses inside an ordinary encrypted HTTPS connection. Traditional DNS travels in plain text, so anyone on the path — the ISP, a Wi-Fi operator, an attacker in a café — can read which domains you visit and even forge the answers. With DoH, lookups are indistinguishable from regular web traffic on port 443.

How DNS over HTTPS works

The client (a browser or the operating system) opens an HTTPS session to a DoH-capable resolver — for example https://cloudflare-dns.com/dns-query — and sends the DNS query as an HTTP request: either GET with a base64url-encoded payload or POST with the binary message body (application/dns-message). The answer returns over the same encrypted channel. The practical effects:

• Confidentiality — on-path observers cannot read queries or responses.
• Transport integrity — tampering with answers in flight would require breaking TLS; authenticity of the zone data itself is the complementary job of DNSSEC.
• Shifted trust — your lookup history is now visible to the DoH resolver operator instead of the ISP, so the provider's privacy policy matters.

DoH in practice

Support is now universal: Firefox, Chrome and Edge expose it as "secure DNS", while Windows 11, macOS, iOS and Android can enable it system-wide. Popular public resolvers include Cloudflare (1.1.1.1), Google (8.8.8.8) and Quad9 (9.9.9.9, which additionally blocks known-malicious domains). Common motivations: protecting lookups on open Wi-Fi, bypassing ISP-level DNS manipulation, and hardening DNS-based content filtering against downgrade.

In managed networks DoH cuts both ways. Because it hides DNS inside web traffic, employees or malware can bypass internal filters and split-horizon DNS, so administrators commonly disable in-browser DoH via policy, block known DoH endpoints, and offer an approved encrypted resolver — often DoT — at the network edge instead. Note that DoH is not an anonymity tool: destination IPs and TLS metadata still reveal a great deal, which is where a VPN differs.