What Is DNS over HTTPS (DoH)? How It Works and Risks

Few things in tech sound as dry as DNS, but the moment you hear your ISP can see every site you visit, it suddenly gets personal. DNS over HTTPS (DoH) changes that by encrypting domain lookups, shifting the balance of power from network operators back to users. But this same encryption also blinds enterprise security tools, creating a tension that makes DoH one of the most debated protocols on the internet right now. By the end of this explainer, you’ll know exactly what DoH does, why it’s controversial, and whether you should turn it on or leave it off.

Protocol standard RFC 8484 (2018) ·
Encryption layer HTTPS (TLS) ·
Default port 443 ·
Major browser support Chrome, Firefox, Edge ·
Public resolver example Cloudflare 1.1.1.1

Six key facts give the full picture of DNS over HTTPS as a protocol.

What is DNS over HTTPS (DoH)?

How does DNS over HTTPS work?

Standard DNS sends your lookup queries in plain text, making them readable to anyone on the network path – your ISP, a coffee‑shop Wi‑Fi operator, or an attacker. DNS over HTTPS (DoH) wraps that query inside an HTTPS request, exactly like loading a webpage, and sends it over port 443. The server decrypts it, resolves the domain, and returns the IP address inside the same encrypted session (Heimdal Security – cybersecurity education platform).

Because the traffic looks identical to regular HTTPS, an observer cannot tell that a DNS lookup just happened. DoH also supports HTTP/2 and HTTP/3, which enable multiplexing and header compression – a performance bonus (VergeCloud – cloud infrastructure analytics).

Why does DNS over HTTPS matter for privacy?

The core promise is simple: DoH prevents third parties from eavesdropping on which domains you visit. That shields you from ISP tracking, DNS hijacking, and man‑in‑the‑middle attacks. As Mozilla’s privacy documentation puts it, “DoH is designed to protect user privacy by preventing third parties from seeing which domains you visit” (Heimdal Security – cybersecurity education platform). For anyone using untrusted Wi‑Fi – airports, hotels, public hotspots – that encryption alone is a major step up from plain DNS.

The implication: DoH turns the DNS lookup from a public broadcast into a private conversation between your device and the resolver. That’s a fundamental shift for online privacy.

Is DNS over HTTPS suspicious?

Why is DNS over HTTPS controversial?

The controversy comes from two directions. First, DoH moves DNS resolution from the operating system to the application (usually the browser), bypassing network‑level filtering that enterprises, schools, and even parents use to block malicious or inappropriate domains (Level1Techs Forum – tech community discussion). Second, the same encryption that protects users also prevents network administrators from seeing which sites employees visit, making threat detection harder.

Because DoH runs on port 443 alongside all other HTTPS traffic, it becomes nearly impossible to block without deep packet inspection. Network teams lose the ability to monitor DNS queries – a key tool for identifying malware callbacks and data exfiltration. According to Cloudflare’s learning centre, “DoH traffic appears as regular HTTPS, reducing network administrator visibility” (Cloudflare – CDN and security provider).

What are the risks of DNS over HTTPS?

Three risks stand out. One, DoH can be configured to use a resolver that logs or sells your browsing data – it shifts trust from your ISP to the resolver operator. Two, if your browser uses a different DoH server than your VPN, your queries can leak outside the VPN tunnel (PrivacyGuides discuss – online privacy community). Three, neither DoH nor DoT protects against DNS cache poisoning; only DNSSEC verifies server identity (Catchpoint – network performance monitoring).

The catch: DoH is a privacy tool, not an anonymity tool. It hides your lookups from eavesdroppers, but the resolver still knows every domain you visit. Choosing a trustworthy resolver is just as important as enabling the protocol.

Why would you block DNS over HTTPS?

Reasons organizations block DoH

Enterprises block DoH for three main reasons: compliance, security monitoring, and content filtering. Financial institutions, healthcare providers, and government agencies must log DNS queries for audit trails or regulatory requirements. DoH encryption directly undermines that logging (Cloudflare – CDN and security provider). Similarly, schools and many corporate networks use DNS filtering to block malware domains; DoH can let employees and students bypass those filters.

How can DoH be blocked?

Blocking DoH isn’t trivial because it shares port 443 with legitimate HTTPS. Common methods include:

• Firewall rules that whitelist only approved resolvers (e.g., company‑controlled DNS)
• Browser group policies that disable DoH or force a specific resolver
• Deep packet inspection (DPI) to identify DoH traffic by TLS‑handshake patterns
• Endpoint security software that prevents browsers from overriding system DNS

Organisations that need to block DoH typically combine network controls with endpoint management policies. The trade‑off is clear: blocking DoH restores visibility at the cost of limiting user privacy.

Should I turn DNS over HTTPS on or off?

Pros and cons of using DoH

For a home user, the scale tilts strongly toward enabling DoH. Your ISP loses the ability to build a browsing‑history profile from your DNS lookups. For an enterprise, the opposite is often true: disabling DoH on managed devices keeps network‑level security tools effective.

Does DoH affect gaming or browsing speed?

DoH introduces a small latency overhead – typically 10–30 milliseconds – because of the HTTPS handshake. For browsing, that’s imperceptible. For online gaming, the difference is negligible compared to other network factors (VergeCloud – cloud infrastructure analytics). The larger concern is DNS leaks when DoH and VPN settings conflict, not raw speed.

Why this matters: For most people, the privacy gain far outweighs the tiny latency increase. Power users should verify that their DoH resolver and VPN are aligned to avoid leaks.

What are the risks of DNS over HTTPS?

DNS leak risks with DoH

A DNS leak happens when your browser sends DoH queries directly to a public resolver instead of through your VPN tunnel. This can occur if the VPN client doesn’t override the browser’s DNS setting (PrivacyGuides discuss – online privacy community). The result: your real IP address is exposed via the VPN‑bypassed DNS queries. Using a split‑tunnel or disabling the browser’s custom DoH when a VPN is active usually solves the problem.

How to tell if you have a DNS leak?

Several free tools detect DNS leaks by comparing the DNS server that resolved your test query against your visible IP. If they don’t match, you have a leak. Common test sites include dnsleaktest.com and ipleak.net. Run the test with and without DoH enabled to confirm your setup is watertight.

The pattern: DoH strengthens privacy against local network snooping, but if not paired correctly with a VPN, it can create a new leak vector. The solution is situational – know your stack.

Comparison: DoH vs DoT vs Plain DNS

Three approaches to DNS, each with a distinct trade‑off between privacy and manageability.

What this means: DoT is the enterprise‑friendly encrypted DNS because it signals “I’m DNS” on port 853. DoH hides in plain sight – great for users, frustrating for network teams. Plain DNS is a security risk on any untrusted network.

Pros and Cons

How to Enable DNS over HTTPS (Step‑by‑Step)

Enabling DoH is straightforward on modern operating systems and browsers. Here’s how to set it up.

Windows 10 & 11

1. Go to Settings → Network & Internet → Properties for your connection (Wi‑Fi or Ethernet).
2. Scroll to IP assignment → click Edit for DNS server assignment.
3. Select Manual → turn on IPv4.
4. Enter preferred DNS: 1.1.1.1 and alternate: 1.0.0.1 (or 8.8.8.8).
5. In the DNS over HTTPS dropdown, choose On (automatic template).
6. Repeat for IPv6 if needed, then save.

Google Chrome

1. Open Chrome → paste chrome://settings/security in the address bar.
2. Under Advanced → Use secure DNS, toggle it on.
3. Choose Use your current service provider or select a custom provider (e.g., Cloudflare, Google).

Mozilla Firefox

1. Open Firefox → go to Settings → Privacy & Security.
2. Scroll to DNS over HTTPS → enable Increase protection.
3. Choose a provider – Cloudflare is default – or use custom. Firefox also supports fallback to plain DNS if DoH fails.

Microsoft Edge

1. Open Edge → paste edge://settings/privacy.
2. Find Use secure DNS → toggle it on.
3. Pick Choose a service provider and select Cloudflare, Google, or custom.

If you run into connectivity issues after enabling DoH, check that your VPN and DoH resolvers don’t conflict – a quick internet outages check can rule out broader problems.

Confirmed Facts vs What’s Unclear

Confirmed facts

• DoH encrypts DNS queries using HTTPS standards to prevent man‑in‑the‑middle attacks
• All major browsers support DoH natively
• RFC 8484 standardizes the protocol (2018)
• DoH uses port 443, making it hard to block without deep packet inspection
• Neither DoH nor DoT prevents DNS cache poisoning – DNSSEC is required

What’s unclear

• Long‑term effect on centralized resolver dominance – will Cloudflare, Google, and Quad9 control too much DNS data?
• Effectiveness against state‑level surveillance if resolver operators are pressured to log
• Whether widespread DoH adoption will increase or reduce enterprise security – most organisations still adapt

Expert Perspectives

“DoH is designed to protect user privacy by preventing third parties from seeing which domains you visit.”

— Mozilla, Privacy documentation

“This document defines a protocol for performing DNS resolution via the HTTPS protocol.”

— IETF, RFC 8484 abstract

These two statements capture the essence of DoH: a privacy‑focused technical standard. But as the controversy shows, privacy for users often means opacity for administrators.

Summary

DNS over HTTPS flips the old DNS model from public broadcast to private request – a genuine win for anyone who values privacy against ISP tracking and on‑path attackers. Yet for IT and security teams, DoH removes a key visibility layer, forcing organisations to adopt new monitoring strategies or block the protocol entirely. The choice isn’t binary: home users should enable DoH with a trusted resolver, while enterprises can steer toward DNS over TLS or enforce DoH‑blocking policies through endpoint management. For the home user in particular, the decision is clear: turn it on, check for DNS leaks, and enjoy an encrypted domain lookup that your ISP can’t read.

Related reading: Internet Outages in My Area · Games for Free: Best No-Download Online Platforms

For a detailed explanation of how this protocol works and its benefits, see our guide on DNS over HTTPS (DoH).

Frequently asked questions