Cybersecurity glossary
What is DNS over HTTPS (DoH)?
Learn what DNS over HTTPS (DoH) is, how DNS queries travel inside HTTPS, how it differs from DoT and traditional DNS, and the privacy and enterprise tradeoffs.
Definition
DNS over HTTPS (DoH) is a protocol that transports DNS queries and responses inside HTTPS, encrypting resolution traffic between a client and a DoH-compatible resolver to improve confidentiality on the path.
Why DoH was created
Classic DNS between stub and resolver is often cleartext UDP/TCP. On shared Wi-Fi or untrusted networks, observers can see which names you resolve and can attempt to interfere. DNS over HTTPS (DoH) wraps those lookups in HTTPS so the path looks like ordinary encrypted web traffic.
That design improves privacy and raises the bar for on-path tampering, while shifting operational control toward whoever runs the DoH endpoint.
How DoH works
Client selects a DoH server
A browser, OS, or app is configured with a DoH URI template or provider.
Open an HTTPS session
The client establishes TLS to the resolver’s HTTPS endpoint, typically on port 443.
Send DNS inside HTTP
Queries travel as HTTP requests carrying DNS messages in a standardized format.
Resolver answers
The DoH service resolves recursively or from cache and returns DNS responses over HTTPS.
Application connects
The client uses the answer like any other DNS result to reach the destination service.
Observers see HTTPS
On-path networks mainly see encrypted traffic to the DoH provider, not cleartext QNAMEs.
DoH compared with other encrypted DNS options
| Property | DoH | DoT | Classic DNS |
|---|---|---|---|
| Transport | HTTPS / HTTP/2 or HTTP/3 | TLS on port 853 | UDP/TCP 53 cleartext often |
| Port blending | Blends with web HTTPS | Distinct DNS-TLS port | Well-known DNS ports |
| Path privacy | Encrypted to resolver | Encrypted to resolver | Visible on path |
| Enterprise visibility | Easier to bypass local DNS policy | Easier to identify and steer | Easy to log and filter |
Benefits and tradeoffs
Confidential queries
Names are hidden from casual network observers between client and resolver.
Harder passive spoofing
TLS authenticity to the DoH endpoint reduces trivial on-path answer injection.
Policy bypass risk
Apps may ignore enterprise resolvers that enforce safe-browsing or split DNS.
Resolver trust shift
Privacy depends heavily on the DoH operator’s practices and jurisdiction.
Deployment checklist
- Choose DoH resolvers with clear logging, retention, and abuse policies.
- For enterprises, publish supported internal DoH endpoints or disable unmanaged DoH.
- Remember DoH does not authenticate zone data—pair with DNSSEC validation where needed.
- Test failure modes when the DoH provider is unreachable.
- Document which applications honor OS DoH versus their own resolver settings.
- Monitor for shadow IT DoH that bypasses security DNS sinks.
- Keep classic DNS hardening for components that cannot speak DoH.
- Educate users that HTTPS to a resolver is not anonymity from that resolver.
The practical takeaway
DNS over HTTPS (DoH) encrypts DNS between clients and a resolver by carrying queries inside HTTPS. It improves on-path privacy and integrity relative to cleartext DNS, while concentrating trust in the chosen DoH operator.
Adopt DoH for hostile networks and privacy goals, but decide deliberately who resolves your names—and how enterprise security policy still sees them.
Related security terms
DNS over TLS (DoT)
Encrypts DNS on a dedicated TLS port instead of multiplexing over HTTPS.
DNS over QUIC (DoQ)
Carries DNS over QUIC for encrypted, multiplexed transport.
DNS Resolver
The service endpoint that answers DoH clients.
HTTPS
The encrypted HTTP transport DoH reuses.
DNSSEC (Domain Name System Security Extensions)
Authenticates DNS data; complementary to DoH’s path encryption.
Frequently asked questions
What is DoH in simple terms?
DoH sends DNS lookups through normal-looking HTTPS connections so people on the network path cannot easily read or tamper with your DNS questions and answers.
Does DoH hide DNS from the resolver operator?
No. The chosen DoH resolver still sees your queries. Encryption protects the path to that resolver, not the resolver itself.
How is DoH different from DoT?
DoH uses HTTPS (usually port 443) and HTTP semantics. DoT uses DNS over TLS on a dedicated port (853). Both encrypt client-to-resolver traffic.
Does DoH replace DNSSEC?
No. DoH protects confidentiality and integrity of the transport to a resolver. DNSSEC helps validate that DNS data was not forged in the hierarchy.
Why do enterprises worry about DoH?
Browsers or apps may bypass corporate recursive DNS, weakening logging, filtering, and DLP based on enterprise resolvers.
Is DoH always more private?
It improves on-path privacy versus cleartext DNS, but centralizing queries at a large DoH provider creates a different visibility tradeoff.
Which RFC defines DoH?
RFC 8484 specifies DNS Queries over HTTPS.
References
Explore authoritative guidance and frameworks related to dns over https (doh).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.