DNS over HTTPS Explained: How DoH Works, Benefits and Risks
DNS over HTTPS, commonly called DoH, sends DNS queries through an encrypted HTTPS connection to a compatible resolver. It is designed to prevent simple observation or modification of DNS queries between the client and resolver.
DoH does not make a user anonymous and does not encrypt the later connection to the destination unless that application connection also uses encryption such as HTTPS.
Compare DNS answers while testing encrypted DNS.
How Does DoH Work?
Traditional DNS commonly uses UDP or TCP port 53. DoH packages DNS messages inside HTTPS requests, usually using the same encrypted web transport that browsers already support.
Step-by-Step Process
- A browser or operating system selects a DoH resolver.
- The client establishes an HTTPS connection to the resolver.
- DNS queries are sent inside the encrypted connection.
- The resolver performs recursive resolution.
- The encrypted response returns to the client.
- The client connects to the destination IP.
Important Concepts
DoH
DNS over HTTPS, typically transported over HTTPS.
DoT
DNS over TLS, commonly using a dedicated TLS service.
DNSSEC
Validates signed DNS data but does not encrypt queries.
HTTPS
Encrypts the application connection to the website, separate from DNS.
Common Problems and Mistakes
- Bypassing company DNS filtering
- Creating inconsistent results between browser and operating system
- Resolver blocked by a network policy
- Captive portal login problems
- Security software unable to inspect or enforce policy
- Incorrect fallback to plaintext DNS
Troubleshooting Checklist
- Choose a reputable resolver.
- Review logging and privacy policies.
- Check whether the organization permits DoH.
- Decide whether plaintext fallback is acceptable.
- Test internal and external domains.
- Confirm which applications actually use DoH.
Frequently Asked Questions
Does DoH hide websites from the ISP?
It hides DNS query contents from simple observation, but destination IP connections and other metadata may still be visible.
Is DoH the same as a VPN?
No. A VPN generally tunnels broader device traffic; DoH encrypts DNS queries to a resolver.
Can DoH break internal domains?
Yes, if the public DoH resolver cannot resolve private company names.
Conclusion
DNS over HTTPS Explained is an important topic for anyone managing websites, networks or online services. Use the diagnostic steps above to separate local-device, resolver, authoritative DNS and application problems.