DNS Over HTTPS in 60 Seconds
- ✓ DNS Over HTTPS wraps DNS queries inside HTTPS traffic, encrypting them so ISPs and network eavesdroppers can't see which domains you're visiting. It's gradually becoming standard on modern devices and browsers, backed by major companies like Apple, Mozilla, and Google—but adoption remains patchy due to organizational complexity, deployment friction, and legitimate tension between privacy and network security monitoring. This guide breaks down exactly what DoH does (stops ISP-level surveillance of DNS queries), what it doesn't (protect against malicious resolvers or malware), how it differs from DoT and DoQ, real deployment challenges in organizations, and why "just encrypt everything" is more complicated in the DNS world than it initially sounds.
What You'll Learn
- DNS Over HTTPS (DoH): Encrypts DNS queries inside HTTPS to improve DNS privacy.
- DNS Privacy & ISP Surveillance: Prevents ISPs and network eavesdroppers from directly seeing your DNS queries.
- DoH vs DoT vs DoQ: Understand the key differences between the three encrypted DNS protocols.
- DoH Security & Limitations: Protects DNS traffic in transit but doesn't prevent malware, malicious resolvers, endpoint compromise, or all traffic analysis.
- DoH Deployment & Secure DNS: Choose trusted resolvers and consider organizational filtering, monitoring, MDM, and security requirements.
DNS Over HTTPS (DoH): The Protocol That's Quietly Solving One of DNS's Oldest Problems
Imagine if every time you typed a web address into your browser, someone was standing outside your window watching you do it. They couldn't see what you were reading once the page loaded—your browser's encryption handled that—but they could see every single domain name you requested.
That used to be the reality of how DNS worked. It still is, for most of the world.
DNS Over HTTPS (DoH) is the protocol quietly fixing that. And while it's been around for a few years now, most people still don't realize it's even possible to encrypt DNS traffic at all, let alone how much of a difference it makes to both security and privacy the moment you understand what's happening beneath the surface.
Why DNS Visibility Became Dangerous
Here's something that might surprise you: your Internet Service Provider can see every single domain you visit. So can anyone running a DNS resolver you use. So can someone with network access between your device and that resolver.
The reason is brutally simple: DNS traffic, until DoH came along, traveled in plaintext.
Who is watching your plaintext DNS?
Internet Service Providers
ISPs have been caught selling DNS query data or mining it to build profiles of user behavior.
Authoritarian Governments
Weaponized DNS visibility to identify and suppress dissidents by tracking domain access.
Advertisers
Purchased DNS data to build impossibly detailed profiles of user behavior and intimate traits.
Hostile Actors
Used DNS visibility to identify which security tools users were installing by watching them query security vendor domains.
DNS visibility is behavioral exposure at the most intimate level. And yet, for decades, this was just how DNS worked. Full stop. No encryption. No privacy.
What DNS Over HTTPS Actually Does (And doesn't)
Let's start with the technical fundamentals, because "wrapping DNS in HTTPS" sounds simple but involves some genuinely important nuances.
Traditional DNS (Port 53)
- 1. Device asks resolver for IP in plaintext
- 2. Query travels unencrypted over network
- 3. Resolver replies in plaintext
- 4. Anyone monitoring sees everything
DoH (Port 443)
- 1. Device encrypts query inside HTTPS
- 2. Query looks like normal web traffic
- 3. Resolver processes and replies securely
- 4. Only you and the resolver know the domain
But here's the critical part that often gets glossed over in explanations: DoH doesn't stop the resolver you're using from seeing your queries.
What it does is make your queries visible only to the DoH resolver you've configured to use, and removes visibility from your ISP, your network administrator, any tool sitting on your home Wi-Fi, anyone routing your traffic. But the resolver still knows.
How DoH Differs from DoT and DoQ
DoH is not the only encrypted DNS protocol. It competes primarily with two others:
DNS over TLS (DoT)
Wraps DNS queries in TLS encryption, but uses a dedicated port (853) instead of blending in with HTTPS traffic. This makes it easier for network administrators to identify and manage DNS traffic, but also easier for firewalls to block if they want to force fallback to plain-text DNS.
DNS over QUIC (DoQ)
The newest standard, built on the UDP-based QUIC protocol. It offers the same encryption but with lower latency and better performance on poor networks, as it avoids the "head-of-line blocking" problem inherent to TCP-based protocols like DoT and DoH.
DoH Won the Visibility Battle, But for Complicated Reasons
DoH has become the de facto standard for consumer encrypted DNS, not because it's technically superior—DoT has some legitimate advantages—but because of how it behaves at the network level. By blending with normal web traffic, DoH is nearly impossible to distinguish from regular browsing, which means:
- Network administrators can't easily block it without blocking all HTTPS traffic
- Censoring regimes can't target it specifically without broader internet disruption
- It works seamlessly over any network that allows HTTPS, including hotel WiFi, coffee shops, and censored countries
That invisibility, ironically, is why major tech companies (Apple, Mozilla, Google) made DoH their default. It bypasses network filtering, which can be a genuine privacy feature in hostile environments but also means it bypasses legitimate network security controls at the same time. This is one of the interesting tensions in DoH deployment that we'll dig into more in a moment.
Privacy Win and the Security Blind Spot
DoH presents a classic trade-off between user privacy and organizational security.
The Privacy Win
For the average user sitting in a coffee shop, DoH is a massive win. It prevents the local Wi-Fi provider, rogue actors on the network, and the upstream ISP from tracking which domains the user visits or manipulating the responses. It secures the "last mile" of DNS resolution.
The Security Complication
For an enterprise security team, that exact same encryption is a nightmare if unmanaged. If a user's browser silently upgrades to DoH and bypasses the corporate DNS resolver, the security team loses their primary mechanism for blocking phishing links, detecting malware command-and-control traffic, and enforcing content policies.
Why "Just Enable DoH" Isn't the Whole Story
If encryption is good, why not just turn it on everywhere immediately? Because DNS is foundational, changing how it works breaks implicit assumptions built into networks over decades.
-
01
Discovery and Configuration
Traditional DNS is discovered automatically via DHCP when a device joins a network. DoH often requires explicit configuration or relies on complex discovery mechanisms (like the DDR standard) that are not yet universally supported.
-
02
Resolver Selection Isn't Neutral
When a browser switches to DoH, it must decide which resolver to use. If it uses a public provider (like Cloudflare), the user's data is now centralized with that provider instead of their ISP. This centralization has sparked intense debate about who controls internet traffic.
-
03
Internal Network Problems
Enterprises rely on internal DNS for things like
intranet.corp. If a browser bypasses local DNS and sends that query to a public DoH resolver, the internal site breaks.
How Encryption Actually Protects DNS
Encrypting DNS isn't just about hiding what websites you visit from your ISP. It addresses several distinct threat vectors:
Man-in-the-Middle Attacks
Because traditional DNS is plain text, anyone on the network path can spoof responses and redirect users to malicious servers. DoH ensures responses are authenticated and haven't been tampered with.
ISP-Level Surveillance
Many ISPs mine plain-text DNS traffic to build profiles of user behavior for advertising. DoH blinds the ISP to which specific domains a user is querying, restoring privacy.
Government Data Collection
In jurisdictions that mandate sweeping data retention, plain-text DNS provides a nearly complete log of citizen activity. DoH disrupts this mass collection by hiding the metadata.
Censorship Circumvention
Authoritarian regimes frequently use DNS filtering to block access to specific websites or news sources. By using an independent DoH resolver, users can bypass local DNS blocks entirely.
What DoH Doesn't Protect Against
But there are important attacks that encryption doesn't prevent: Traffic Analysis - As mentioned earlier, the size of DNS queries and the timing patterns can sometimes leak information. If an observer knows you're visiting one of three possible sites and can see the query size and timing, they might infer which one. This is rare and requires sophisticated analysis, but it's a real limit to DoH's privacy. Malicious Resolvers - If the DoH resolver you're using is malicious or compromised, they see everything. Encryption only protects you from observers on the network path, not from the resolver itself. Application-Layer Leaks - Even if DNS is encrypted, you might leak your browsing behavior through other channels. Your browser might request a domain in its search suggestions. Your email client might send device names. Your apps might phone home with unencrypted identifiers. DoH solves DNS; it doesn't solve all privacy. Endpoint Compromise - If your device is malware-infected or compromised, none of the encryption in the world matters. The malware can see queries before they're encrypted. Metadata - Even if the resolver can't see your queries, they can see your IP address, the volume of traffic, and the timing. That's still behavioral data. DoH is powerful and important. But it's not magic. It solves a specific problem—DNS query privacy in transit—and does so very well. It doesn't solve all privacy problems, and privacy advocates sometimes overstate what it provides.
Deployment Realities: How Organizations Actually Implement DoH
The reality of deploying DoH varies wildly depending on who is doing it.
For Individual Users
Easy, but confusing. Browsers often enable it automatically, but users rarely understand which resolver they are actually using or the privacy implications of that choice.
The Certificate Authority Problem
If you run an internal DoH resolver, every endpoint must trust the TLS certificate of that resolver. Pushing custom root certificates to every BYOD device is a logistical nightmare.
MDM Complexity
Configuring DoH at the OS level (e.g., via Apple profiles) is the best way to ensure coverage, but it requires mature Mobile Device Management infrastructure.
The Filtering Complication
To filter malware, the designated DoH resolver must be capable of inspecting queries and applying policy, not just blindly resolving them.
The Standards-Based Future: What's Actually Shipping
DoH has been an RFC (RFC 8484) since 2018, which means it's officially a standard. But the practical rollout has been messy because different organizations have different priorities.
Where DoH Is Default Now
Browsers: Firefox ships with DoH enabled by default (in the US; it's configurable in other regions). Chrome is moving toward it gradually. Safari and Edge support it but often default to ISP resolvers. Brave, Opera, and other browsers have it enabled by default. Operating Systems: macOS, Windows 11, iOS, and recent Android versions all have native DoH support, though it's not always enabled by default. Mobile: iOS and Android both support DoH, and more apps are starting to use it automatically. ISPs: A few forward-thinking ISPs are offering DoH services directly, though most haven't. Enterprise: Some enterprise security platforms now support DoH, but adoption is still patchy.
The Adoption Curve
The general trend is positive. More devices support it. More resolvers offer it. More organizations are deploying it. But adoption is still far from universal. A reasonable estimate is that somewhere between 20-35% of internet users have DoH enabled in some form—mostly in developed countries, mostly on mobile devices and browsers, less on enterprise networks.
What's Still Missing
For DoH to become truly universal, a few things would need to happen: Better discovery: Users need an easier way to know which resolver to use. Right now, it's mostly word-of-mouth and tech blogs. There should be something like a "show me reputable DoH providers" interface in operating systems. ISP adoption: If ISPs provided DoH resolvers by default, deployment would accelerate dramatically. Some are, but most aren't. Enterprise integration: Organizations need DoH to integrate more seamlessly with their existing security, monitoring, and management infrastructure. This is getting better but isn't there yet. Performance guarantees: While DoH is fast enough in practice, there's no standardized way to guarantee SLAs or measure performance across different resolvers, which matters for organizations. Standardized policy: Right now, organizations wanting to deploy DoH internally must build a lot of it from scratch. Having standardized configuration and policy templates would help.
A Real-World Deployment Checklist
Rolling out DoH effectively requires coordination across network, identity, and security teams. Here is how organizations are doing it in practice:
-
1
Define the Endpoint Strategy First
Decide how you will push DoH settings. MDM (Mobile Device Management) profiles for macOS and iOS, and Group Policy or Intune for Windows, are the only ways to ensure DoH is used universally across corporate devices without user intervention.
-
2
Establish the Designated Resolver
You must have a designated corporate DoH resolver (like olladns) that applies your security policies. If you simply turn DoH on without specifying the resolver, browsers may default to public providers, bypassing your corporate filtering entirely.
-
3
Handle Internal Domains
This is the most common failure point. Ensure your DoH configuration explicitly bypasses the encrypted resolver for internal domains (e.g.,
*.corp.internal) and routes those queries to your internal plain-text DNS servers, otherwise internal apps will break. -
4
Disable Browser Overrides
Use enterprise policies to lock the browser's DNS settings. If a user can manually change Chrome or Firefox to use a different DoH provider, they can bypass all corporate security controls and filtering policies.
The Reality of DoH in Hostile Environments
Most discussions of DoH assume a somewhat neutral network environment. But in censored countries and hostile networks, DoH looks very different.
The Circumvention Value
For someone living in a country with heavy internet filtering, DoH to a resolver outside the country can be genuinely life changing. It can make censored information accessible. It can prevent governments from tracking which forbidden websites people access. This is why censoring regimes often try to block DoH specifically. Some countries are now implementing Trickbot tactics—blocking known DoH resolver IPs, monitoring for the distinctive traffic patterns of encrypted DNS, even in some cases blocking entire ports or protocols associated with DoH. This has led to an arms race where privacy advocates are working on DoH techniques that are even harder to detect and block.
The Organizational Firewall Problem
Conversely, if an organization is trying to operate in a heavily censored country and needs to use local infrastructure, DoH that bypasses all filters can be a problem. An employee using DoH with an external resolver could accidentally access blocked content that gets them and the organization in legal trouble. Different organizations have handled this differently—some embrace DoH for privacy, others actively block it.
Common DoH Misconceptions
Because DoH sits at the intersection of privacy advocacy and enterprise security, it has generated significant confusion. Let's clear up the most persistent myths:
"DoH hides everything from my employer"
False. If you are using a corporate device or a corporate network, your employer likely mandates the use of their own DoH resolver or decrypts HTTPS traffic using a proxy. DoH encrypts the traffic on the wire, but it doesn't hide the destination from the entity operating the resolver.
"DoH makes malware invisible"
Partially true, but mostly false. While legacy network monitoring tools can't passively sniff DoH traffic, modern security architectures (like Protective DNS) integrate the inspection directly into the resolver itself. Malware using DoH is just as visible to the designated resolver as plain-text DNS.
"DoH is slower than regular DNS"
In theory, the overhead of HTTPS encryption adds latency. In practice, modern connection pooling, HTTP/2 multiplexing, and robust resolver caching mean the performance difference is negligible, and often faster than slow ISP-provided plain-text resolvers.
Frequently Asked Questions
The Bottom Line: Small Change, Big Impact
DNS Over HTTPS is a technology that works quietly in the background. Most people using it don't think about it. But it represents something important: the recognition that a 40-year-old protocol designed before surveillance was a concern needed updating for a world where privacy can't be assumed. DoH doesn't solve everything. It doesn't stop sophisticated attacks, doesn't protect against malware, doesn't make you completely anonymous. But it does something that matters, it stops your ISP from knowing everywhere you go online. It stops a basic form of surveillance that used to be completely routine. That's worth something. More than worth something. It's the kind of foundational infrastructure change that doesn't make headlines but makes the internet a little bit less hostile to privacy. The fact that it's still not default everywhere is mostly inertia—technical organizations slow to change, ISPs resisting visibility loss, organizations trying to maintain filtering capabilities. But the direction is clear. DoH is becoming baseline. Not immediately, not everywhere, but gradually, the web is moving toward encrypted DNS as standard. And in a world where your DNS queries used to be about as private as reading your browser history in the airport, that shift matters.
The Honest Take: What DoH Is and Isn't
DoH is not a silver bullet, nor is it the end of network security visibility. It is a necessary evolution of a protocol that was designed for a friendlier internet.
For individual users, it provides crucial protection against local surveillance and manipulation. For enterprises, it requires a shift in architecture: moving DNS security from passive network inspection to active, endpoint-aware encrypted resolution.
The goal is no longer to stop DNS encryption—it is to manage it.