DNS over HTTPS

What Is DNS over HTTPS (DoH)?

DNS over HTTPS (DoH) is a protocol for encrypting DNS lookups, and it does this by carrying each one inside HTTPS, the same secure connection a browser uses for web pages. DNS itself, short for Domain Name System, converts a name such as example.com into an IP address; without that address, a device has nowhere to connect. In standard DNS, the request goes out as plain text, so anyone watching the network path can read it.

DoH changes that. The request is encrypted before it leaves the device and stays that way until it reaches the DNS resolver, which is the server that looks up the address and replies. RFC 8484 is the document that sets out how DoH works.

Example: Say an employee logs in to a company portal from a hotel's Wi-Fi. With standard DNS, the hotel network can log every domain the laptop looks up. With DoH on, it sees only an encrypted session to a resolver.

DoH is built into web browsers, desktop and mobile operating systems, and many DNS resolvers. Like several newer network protocols, it adds encryption to a service that was originally designed without any.

How Does DNS over HTTPS Work?

DNS over HTTPS works by wrapping each DNS request in an ordinary HTTPS request and sending it to the resolver on port 443, which secure websites also use. From start to finish, a lookup follows four steps:

1. The browser or operating system builds a standard DNS request.

2. Next, that request goes over an encrypted HTTPS connection to the resolver's DoH address, which looks like a normal web URL (for example, https://resolver.example/dns-query).

3. On receipt, the resolver decrypts it and gets the IP address, either from its cache or by asking other DNS servers. The answer is encrypted again for the trip back.

4. The device reads the address and connects to the website or service.

The first lookup takes slightly longer while the encrypted connection is set up. The connection then stays open, so the extra network latency on later lookups is usually small.

DNS over HTTPS vs Traditional DNS

DNS over HTTPS and traditional DNS differ on two points. The first is who can read the request; the second is who gets to choose the resolver.

Is plain DNS safe? It does its job reliably. Anyone on the path, though, can read the traffic or even change it. DoH covers the request while it's moving. Checking that the answer itself is genuine is a separate job, handled by DNSSEC, which adds digital signatures to DNS records.

What Is the Difference Between DNS over HTTPS and DNS over TLS?

DNS over HTTPS and DNS over TLS (DoT) share one encryption standard, TLS (Transport Layer Security). Where they differ is in how their traffic moves across the network.

• DoT uses its own port, 853. A firewall can spot it easily and allow or block it by rule.

• DoH uses port 443, shared with all secure web traffic. It is hard to tell apart from normal browsing.

Both are equally secure. Organizations that want tight control over DNS often choose DoT.

What Are the Benefits of DNS over HTTPS?

DNS over HTTPS protects the lookup between a device and its resolver. That brings four main benefits:

• Privacy: Internet providers, Wi-Fi operators and others on the network can't see which domains a user looks up.

• Protection from spoofing: Attackers can't quietly swap in a fake answer that sends users to a malicious site.

• Safer public Wi-Fi: It treats every local network as untrusted, which fits zero trust principles.

• Resistance to interference: Networks that block or rewrite DNS answers find it much harder to do so.

What Are the Limitations of DNS over HTTPS?

DNS over HTTPS protects only part of the journey and brings trade-offs of its own:

• The resolver still sees everything: Every lookup is visible to whichever DoH provider handles it.

• Destinations can still show: The IP address a device connects to can reveal the site being visited.

• Fewer, larger providers: When browsers default to a few big public resolvers, those providers see a very large share of internet lookups.

• Harder diagnosis: Encrypted lookups no longer appear in packet traces, which makes network troubleshooting slower.

Why Is DNS over HTTPS Controversial?

DNS over HTTPS is controversial because the encryption that protects users also hides DNS activity from the people who secure the network. When a browser sends DoH lookups to an outside resolver, it can bypass enterprise controls without warning:

• Filters stop working: Content and malware blocklists on the company resolver never see the request.

• Internal names fail: Split-horizon DNS, where internal hostnames resolve only on company servers, breaks.

• Security logs go quiet: The DNS trail a SIEM uses to spot threats disappears.

• Attackers gain cover: Malware can hide command-and-control traffic, the channel that sends instructions to infected machines, inside DoH.

How Is DNS over HTTPS Different from a VPN?

DNS over HTTPS encrypts only DNS lookups, while a VPN (virtual private network) encrypts all traffic leaving a device.

• Scope: DoH hides which domains a user looks up. A VPN hides the lookups and the traffic that follows.

• Visibility: With DoH, the local network can still see which IP addresses a device connects to. A VPN hides those too.

• Use case: DoH adds lightweight privacy to browsing. A VPN suits secure remote access to company systems.

Should You Turn On DNS over HTTPS?

Whether to turn on DNS over HTTPS depends on the network. On personal devices using home or public Wi-Fi, it adds privacy at little cost. On a corporate network, the usual approach is to point DoH at the company's own resolver.

To turn it on:

• In a browser: In privacy or security settings, switch on secure DNS and choose a provider.

• In the operating system: In the network adapter's DNS settings, enter a DoH-capable server and set encryption to encrypted only.

• Across a company: Push the setting to all devices through group policy or endpoint management tools.

To check it's working:

• Confirm the secure DNS setting shows as active in the browser or operating system.

• Run a packet capture while browsing. If pages load but no lookups leave on port 53, DNS is encrypted.

• Open the test page many DoH providers publish to confirm your request arrived encrypted.

How Does DNS over HTTPS Affect Enterprise Network Visibility?

DNS over HTTPS reduces enterprise network visibility, because encrypted lookups no longer appear in DNS logs. Organizations can keep control through policy and continuous monitoring:

• Set device policy: Point browsers and operating systems at the company resolver, and configure the canary domain, a test name some browsers check before turning DoH on by themselves.

• Block outside resolvers: Use access control lists to deny connections to known public DoH servers on port 443, and block port 853 outbound.

• Watch traffic flows: Flow records show which devices talk to which addresses, so long-running sessions to known DoH resolvers stand out.

• Connect the evidence: Combine firewall, proxy and resolver logs so event correlation can tie an unexpected DoH session to a device and user.

• Monitor resolver health: If clients rely on an internal DoH resolver, set alerts for its response time, error rate and certificate expiry. When that resolver goes down, nobody on the network can resolve names.

With these controls in place, employees get private lookups on untrusted networks, and the organization still has the visibility to catch threats and fix outages quickly.