DNS over HTTPS: The Future of Private DNS

Every time you type a URL into your browser, your device sends a plain-text DNS query across the internet before a single encrypted byte of your actual request leaves your machine. That query tells your ISP, your coffee shop's router, and any passive observer exactly which domains you visit, even when the sites themselves use HTTPS. DNS over HTTPS, commonly written as DoH, fixes that leak by wrapping DNS queries inside standard HTTPS traffic. It is not a theoretical future upgrade — it is available right now in every major browser and operating system, and enabling it takes about two minutes. This guide explains exactly how it works, why it matters, and how to turn it on everywhere you use the internet.

What DNS over HTTPS Actually Does

Traditional DNS uses UDP port 53. Queries travel in cleartext, meaning the domain name you are resolving is fully visible to anyone on the path between your device and your DNS resolver. Your ISP logs those queries by default. Captive portals intercept them. Attackers on public Wi-Fi can read them, modify them, or redirect them to malicious servers through a technique called DNS spoofing.

DoH sends those same DNS queries over an encrypted HTTPS connection to port 443, the same port used for normal web browsing. From a network observer's perspective, a DoH query is indistinguishable from loading a webpage. The resolver on the other end decrypts the query, performs the lookup, and returns the answer over the same encrypted channel. Nobody in the middle can read the query or tamper with the response.

The competing standard, DNS over TLS (DoT), uses port 853 and achieves similar encryption. The practical difference is that DoT is easy to block at a firewall level because it uses a dedicated port, while DoH blends into normal HTTPS traffic and is much harder to intercept or censor.

Why This Matters More Than Most People Realize

Privacy advocates often focus on HTTPS as the solution to surveillance, but HTTPS only encrypts the content of your requests. DNS queries happen before the connection is established and reveal the destination regardless. A network-level observer watching your traffic does not need to break TLS encryption — they simply read your DNS queries and know every site you visited, every app you used, and roughly when you used them.

The consequences are real and present:

• ISP data collection: In many countries, ISPs are legally permitted or required to log DNS traffic. That data is sold to advertisers or handed to law enforcement.
• DNS hijacking: Some ISPs intercept DNS queries destined for third-party resolvers and redirect them to their own servers, regardless of what you configured.
• Public Wi-Fi attacks: A rogue access point can silently redirect your DNS queries, serving fake IP addresses for banking sites or email providers.
• Censorship: DNS blocking is the cheapest and most common form of content filtering. DoH bypasses most DNS-based blocks because the query never reaches a local resolver that enforces the block list.

Choosing a DoH Resolver

You need a resolver that actually supports the DoH protocol. The most widely used options are:

• Cloudflare (1.1.1.1): DoH endpoint https://cloudflare-dns.com/dns-query. Cloudflare commits contractually to not selling query data and deletes logs within 24 hours.
• Google Public DNS: DoH endpoint https://dns.google/dns-query. Fast and reliable, though Google does log queries for security analysis.
• Quad9 (9.9.9.9): DoH endpoint https://dns.quad9.net/dns-query. Non-profit, blocks known malicious domains, strong privacy policy.
• NextDNS: DoH endpoint varies per account. Offers per-device filtering, detailed query logs under your own control, and ad/tracker blocking.

Pick based on your priorities. For pure privacy without logging, Cloudflare or Quad9 are the standard recommendations. For family filtering or security analytics, NextDNS is worth the extra setup.

Enabling DoH in Major Browsers

Google Chrome and Microsoft Edge

Both browsers use the same Chromium settings path:

1. Open Settings and navigate to Privacy and security.
2. Click Security.
3. Scroll to Advanced and find Use secure DNS.
4. Select With a specific provider and choose your resolver from the dropdown, or paste a custom DoH URL.

Edge follows an identical path under Settings > Privacy, search, and services > Security.

Mozilla Firefox

Firefox was one of the first browsers to ship DoH and has a slightly different flow:

1. Open Settings and scroll to Network Settings at the bottom of the General page.
2. Click Settings... next to Connection.
3. Scroll to the bottom of that dialog and check Enable DNS over HTTPS.
4. Select a provider from the dropdown or enter a custom URL.

Firefox also supports a "Max Protection" mode that refuses to fall back to plaintext DNS if DoH fails, which is the safest option for privacy-focused users.

Safari

Safari does not expose a native DoH toggle. On macOS and iOS, you need to configure DoH at the operating system level, covered in the next section.

Enabling DoH at the Operating System Level

Browser-level DoH only covers traffic from that browser. Other apps — mail clients, system updaters, VoIP software — still use plaintext DNS. System-level configuration closes that gap.

Windows 11

1. Open Settings > Network and Internet.
2. Click your active connection (Ethernet or Wi-Fi).
3. Click Edit next to DNS server assignment.
4. Switch to Manual, enable IPv4, and enter your preferred DNS IP (for example, 1.1.1.1 and 1.0.0.1 for Cloudflare).
5. Set the DNS over HTTPS dropdown for each server to On (automatic template).

Windows 10 requires a registry edit or the use of a third-party tool like YogaDNS or Simple DNSCrypt, since the native GUI does not expose the DoH toggle.

macOS Ventura and Later

Apple introduced encrypted DNS profile support in macOS 11. The cleanest approach is to install a configuration profile from your DoH provider. Cloudflare publishes a free profile at 1.1.1.1/dns/. Download and double-click the .mobileconfig file, then approve it under System Settings > Privacy and Security > Profiles. The profile forces all system DNS traffic through DoH without requiring third-party software.

iOS and iPadOS

Identical to macOS — install a configuration profile. Cloudflare's 1.1.1.1 app also handles this automatically and is the easiest path for non-technical users.

Android 9 and Later (Private DNS)

Android uses DNS over TLS rather than DoH for its system-wide encrypted DNS feature:

1. Open Settings > Network and Internet > Private DNS.
2. Select Private DNS provider hostname.
3. Enter a DoT hostname such as one.one.one.one for Cloudflare or dns.quad9.net for Quad9.

This applies to all network traffic on the device regardless of which app generates it.

Enabling DoH on Your Router

If you configure DoH on the router, every device on your network benefits automatically — including smart TVs, game consoles, and IoT devices that have no per-device DoH settings.

Router support varies significantly by firmware. Here are the paths for the most common home router brands:

ASUS Routers (asusrouter.com or 192.168.1.1)

Newer ASUS firmware includes DoT/DoH support under WAN > DNSPrivacy Protocol. Set the protocol to DNS-over-HTTPS and enter the resolver URL. Models on Merlin firmware gain additional options including per-client overrides.

TP-Link (tplinkwifi.net or 192.168.0.1)

Standard TP-Link firmware does not natively support DoH. The workaround is to run a local DoH proxy such as cloudflared on a Raspberry Pi or small server on the network, then point the router's DNS to that local address. TP-Link routers running OpenWrt support DoH natively through the https-dns-proxy package.

Netgear (routerlogin.net or 192.168.1.1)

Netgear's Nighthawk and Orbi lines support setting custom DNS servers under Advanced > Setup > Internet Setup or WAN Preferences. Native DoH is not available without third-party firmware, but setting the DNS IP to a DoH-capable resolver at minimum reduces the interception risk on your LAN segment.

Running a Local DoH Proxy with Cloudflared

For maximum control, run Cloudflare's cloudflared daemon as a local DoH proxy. It listens on 127.0.0.1:53, accepts standard DNS queries from any app, and forwards them encrypted over DoH to Cloudflare. This works on Linux, macOS, Windows, and Raspberry Pi.

Once running, point your system or router's DNS to 127.0.0.1 (or the LAN IP of the machine running cloudflared). Every DNS query on that machine or network segment now travels over DoH.

Verifying That DoH Is Working

Do not assume your configuration is working — verify it. Use the DNS Lookup tool to confirm which resolver is answering your queries and check whether the responses match what authoritative servers publish. For a direct DoH test, Cloudflare's 1.1.1.1/help page shows whether your queries are reaching their DoH endpoint and whether DNS over HTTPS is active for your current connection.

You can also test from the command line using curl to make a raw DoH request:

If the curl request succeeds but your browser still shows plaintext DNS in a packet capture, double-check that the browser's secure DNS setting is enabled and that no group policy or MDM profile is overriding it.

Potential Drawbacks and Trade-offs

DoH is not without criticism. The primary concern is that it centralizes DNS traffic with a small number of large providers. If Cloudflare or Google experiences an outage, a significant portion of internet users lose DNS resolution simultaneously. Traditional DNS is distributed by design; DoH as commonly deployed trades that resilience for privacy.

Network administrators also have legitimate objections. Corporate environments use internal DNS to resolve private hostnames and enforce security policies. DoH that bypasses the corporate resolver breaks internal name resolution and visibility tools. This is why enterprise DoH deployments typically use a managed resolver that supports DoH and enforces company policy rather than disabling DoH entirely.

Performance impact is minimal on modern hardware and connections. The TLS handshake adds a small latency overhead on the first connection, but persistent HTTPS connections reuse the same TLS session for many queries, eliminating the per-query overhead after the initial connection is established.

Preventing Regressions

The biggest risk after enabling DoH is silent fallback. Many implementations, including Firefox and Windows, can fall back to plaintext DNS if DoH fails. For a privacy-critical setup, disable fallback explicitly. In Firefox, set the DNS over HTTPS mode to Maximum Protection. In Windows, ensure the DoH preference is set to require encryption rather than prefer it. On mobile, avoid switching between networks without verifying that the encrypted DNS profile remains active after reconnecting.

Check your configuration after any major OS update. Operating system upgrades occasionally reset DNS settings to defaults, silently reverting your privacy configuration without any notification.

DoH is one of the most straightforward privacy improvements available today. It requires no special hardware, no subscription, and no deep technical expertise. Five minutes of configuration eliminates a surveillance channel that has been open since DNS was designed in 1983.