DNS over HTTPS Explained How It Works and Why It Matters

Every time you type a web address into your browser, your device sends a plain-text DNS query across the network to resolve that name into an IP address. For decades, those queries traveled completely unencrypted, visible to your ISP, your router, anyone on the same Wi-Fi, and any network device in between. DNS over HTTPS, commonly abbreviated as DoH, changes that by wrapping DNS queries inside the same encrypted HTTPS tunnel used for secure web traffic. It sounds simple, but the implications for privacy, security, and even corporate IT policy are significant enough that it has become one of the most debated protocol changes in recent networking history.

What DNS over HTTPS Actually Does

Traditional DNS queries use UDP port 53 and travel in cleartext. A packet capture on any network reveals exactly which domains a device is querying, when, and how often. DNS over HTTPS sends those same queries as standard HTTPS requests to a DoH resolver, typically over TCP port 443. To any network observer, the traffic is indistinguishable from a normal HTTPS connection to a web server.

The core change is confidentiality. A DoH query is encrypted end-to-end between your device and the DoH resolver. Your ISP, employer network, or a malicious hotspot operator cannot read or tamper with those queries without breaking TLS, which is computationally infeasible in practice.

DoH vs. DNS over TLS

DNS over TLS (DoT) achieves a similar goal but uses a dedicated port, TCP 853. Because DoT traffic is obviously DNS traffic on a unique port, network administrators can block it easily with a firewall rule. DoH traffic runs on port 443 alongside all other HTTPS traffic, making it much harder to selectively block. This difference is exactly why DoH is controversial in enterprise environments and exactly why it offers stronger practical privacy protection for consumers.

Why Plain DNS Is a Real Security Risk

The threat model for unencrypted DNS is not theoretical. Several concrete attacks target it regularly:

• DNS spoofing and cache poisoning: An attacker intercepts your UDP DNS query and returns a forged response pointing to a malicious IP address before the legitimate resolver can reply. Without DNSSEC or encryption, your device has no way to detect the forgery.
• ISP query logging and selling: Many ISPs log DNS queries and use that data for targeted advertising or sell it to data brokers. Every site you visit is captured, timestamped, and linked to your account.
• Captive portal hijacking: Public Wi-Fi operators often intercept DNS to redirect users. Malicious hotspots exploit the same mechanism to redirect banking sites or inject ads.
• Man-in-the-middle on corporate or hotel networks: Network hardware can silently rewrite DNS responses to block content, track users, or in hostile environments, redirect to phishing pages.

DoH does not eliminate all of these risks entirely, but it removes the ability to silently intercept and manipulate DNS without the user's knowledge.

How a DoH Query Works Step by Step

1. Your browser or operating system needs to resolve example.com.
2. Instead of sending a UDP packet to port 53, it constructs an HTTPS GET or POST request to the configured DoH resolver URL, for example https://cloudflare-dns.com/dns-query.
3. The request carries the DNS query encoded in DNS wire format, either as a URL parameter (application/dns-message) or in the POST body.
4. The DoH resolver receives the request over a standard TLS connection, processes the DNS lookup, and returns the response in the same wire format inside the HTTPS response body.
5. Your browser decodes the response and uses the IP address to connect to the destination server.

The entire round trip looks like any other HTTPS request. A network observer sees a TLS handshake to the resolver's IP and encrypted data. Nothing more.

Major Public DoH Resolvers

Several well-known public resolvers support DoH. Each has different privacy policies and performance characteristics:

• Cloudflare (1.1.1.1): DoH URL is https://cloudflare-dns.com/dns-query. Cloudflare commits to deleting logs within 24 hours and not selling query data. Generally the fastest resolver globally.
• Google Public DNS: DoH URL is https://dns.google/dns-query. High reliability and speed. Google retains logs for a limited period per their privacy policy.
• Quad9 (9.9.9.9): DoH URL is https://dns.quad9.net/dns-query. Blocks known malicious domains at the resolver level. Non-profit operated.
• NextDNS: DoH URL is unique per account. Offers configurable filtering, logging, and analytics. Useful for families or small businesses.

Enabling DoH in Major Browsers

Google Chrome and Chromium

Chrome calls this feature Secure DNS. Navigate to:

Scroll to the Advanced section and find Use secure DNS. Toggle it on, then choose With a specific provider if you want to select Cloudflare, Google, or enter a custom DoH URL. Chrome also supports automatic mode, where it upgrades to DoH automatically if your current DNS provider supports it.

Mozilla Firefox

Firefox was one of the first browsers to ship DoH by default for US users. To configure it manually:

1. Open Settings and go to General.
2. Scroll to the bottom and click Network Settings.
3. Check Enable DNS over HTTPS.
4. Choose a provider from the dropdown or enter a custom URL.

Firefox uses its own DoH resolver independent of the operating system setting, which means it bypasses any OS-level DNS configuration. This is intentional for privacy but can conflict with enterprise split-horizon DNS setups.

Microsoft Edge

Edge inherits Chrome's Secure DNS feature. Go to:

Find Use secure DNS to specify how to lookup the network address for websites and enable it. The provider selection works identically to Chrome.

Safari

Safari on macOS and iOS does not have a browser-level DoH toggle as of this writing. DoH on Apple platforms is configured at the operating system level using configuration profiles or the system settings described below.

Enabling DoH at the Operating System Level

Windows 11

Windows 11 supports DoH natively in the network adapter settings:

1. Open Settings, then Network and Internet.
2. Click your active network adapter (Ethernet or Wi-Fi), then click Edit next to DNS server assignment.
3. Set DNS to Manual, enter a public DoH resolver IP (such as 1.1.1.1 and 1.0.0.1 for Cloudflare).
4. Under DNS over HTTPS, select On (automatic template) for known resolvers or enter the DoH URL manually.

Windows matches the IP address you enter against a built-in list of known DoH providers and selects the correct URL automatically for Cloudflare, Google, and Quad9.

Windows 10

Windows 10 does not have a native GUI for DoH. You can enable it via a registry key or by using a local DoH proxy such as dnscrypt-proxy:

After adding the key, restart the DNS client service. This enables experimental DoH support but requires the DNS server IPs configured to be known DoH-capable resolvers.

macOS (Ventura and later)

Apple introduced system-level encrypted DNS through configuration profiles. The simplest method for a consumer is to download a DoH profile from a provider such as Cloudflare (available at 1.1.1.1/dns/) and install it via System Settings under VPN and Device Management. Alternatively, tools like dnscrypt-proxy installed via Homebrew run a local DoH proxy that the entire system uses.

Linux

Most Linux distributions use systemd-resolved or a traditional resolv.conf setup. systemd-resolved added DoT support but DoH support varies by distribution version. The most reliable cross-distro approach is running dnscrypt-proxy:

Then point your system resolver to 127.0.0.1 in /etc/resolv.conf or via your network manager.

Verifying That DoH Is Working

After enabling DoH, confirm it is active before trusting it. The simplest method is to visit Cloudflare's browser check page at https://1.1.1.1/help if you are using their resolver. It reports whether your queries are arriving over an encrypted connection.

For command-line verification, use curl to make a raw DoH query directly:

This sends a DoH request in JSON format and returns the resolved IP addresses. If you get a valid response, the resolver endpoint is reachable and working. You can also use the DNS Lookup tool on this site to query specific record types and verify that your domain resolves correctly through multiple vantage points.

For deeper verification, run a packet capture with Wireshark and filter for udp.port == 53. With DoH properly configured, you should see zero plaintext DNS queries leaving your interface during normal browsing.

Limitations and Considerations

DoH is not a complete privacy solution on its own. The IP address of the server you connect to after DNS resolution is still visible. The TLS Server Name Indication (SNI) field in HTTPS connections also leaks the hostname you are connecting to, though Encrypted Client Hello (ECH) is working to address that separately.

DoH also bypasses split-horizon DNS setups used in corporate VPNs and enterprise environments. If you enable DoH in Firefox or Chrome on a corporate laptop, internal hostnames may stop resolving because they only exist in the company's internal DNS and not on Cloudflare's or Google's resolvers. Enterprise IT teams often push policies to disable browser-level DoH for this reason. If you are on a corporate device, check with your IT department before enabling DoH.

Finally, DoH shifts trust from your ISP to your chosen DoH resolver. You are trading one party that can see your queries for another. Choosing a resolver with a transparent, audited privacy policy matters. Cloudflare's 1.1.1.1 service is independently audited by KPMG annually, which sets it apart from many alternatives.

Should You Enable DoH

For most home users and anyone using public Wi-Fi regularly, enabling DoH in the browser is a low-effort, meaningful privacy improvement. It takes under two minutes to configure, has no noticeable performance impact with major resolvers, and eliminates a class of passive surveillance and active tampering attacks that have existed since DNS was invented in 1983.

For IT professionals managing networks, the conversation is more nuanced. DoH requires deliberate policy decisions about which resolvers are permitted, how to handle split-horizon DNS, and how to maintain visibility into DNS traffic for security monitoring. Network-level DoH enforcement using DNS firewall policies, or deploying an internal DoH resolver that logs appropriately, gives the benefits of encryption while preserving necessary oversight.

The underlying principle is clear: unencrypted DNS is a design flaw that DoH corrects. The specific implementation path depends on your environment, but the direction of travel is obvious. Encrypted DNS is where the industry is heading, and getting ahead of that curve rather than scrambling to catch up is the pragmatic position.