What is DNS over HTTPS (DoH)?
Last updated: April 21, 2026
Definition
DNS over HTTPS (DoH) is a protocol that encrypts Domain Name System queries by transmitting them through HTTPS connections over port 443. DoH makes DNS resolution requests indistinguishable from regular encrypted web browsing, preventing ISPs, network operators, and attackers from intercepting, monitoring, or manipulating DNS queries during transmission. Major browser vendors including Firefox, Chrome, and Edge integrated native DoH support starting in 2020.
Key Facts
- Also known as: DNS-over-HTTPS, encrypted DNS
- Category: Network Security / Cybersecurity
- Related standards: RFC 8484 (October 2018), TLS 1.2 or higher
- Key implementations: Cloudflare 1.1.1.1, Google Public DNS 8.8.8.8, Quad9 9.9.9.9, Mozilla Firefox, Google Chrome, Microsoft Edge
- First standardized: 2018 (IETF RFC 8484)
How DNS over HTTPS Works
When a client makes a DNS query, DoH encodes that query as an HTTP GET or POST request with media type "application/dns-message" and sends it to a DoH-compatible resolver over an encrypted TLS connection on port 443. The resolver processes the query and returns the DNS response over the same encrypted channel. Because DoH uses port 443 (the standard HTTPS port) rather than the traditional DNS port 53 or the DNS over TLS port 853, DoH traffic blends into normal HTTPS web traffic and becomes difficult for network operators to identify, intercept, or block.
The protocol inherits all TLS security properties, including certificate validation, cipher suite negotiation, and session resumption. Browser implementations (Firefox, Chrome, Edge) perform DoH queries by bypassing the operating system's DNS resolution stack and communicating directly with configured DoH resolvers. This means DoH-enabled applications control their own DNS behavior independent of system-level DNS settings. Enterprise deployments can run internal DoH resolvers or configure endpoints to use enterprise-controlled DoH servers rather than public resolvers, maintaining visibility while encrypting DNS traffic between endpoints and the corporate DNS infrastructure.
Why DNS over HTTPS Matters
Without encrypted DNS, every DNS query travels in plaintext across the network, exposing browsing patterns to ISPs, network administrators, and attackers positioned anywhere on the path between client and resolver. This visibility enables DNS hijacking, man-in-the-middle attacks, surveillance, and DNS-based censorship. DoH eliminates this exposure by wrapping DNS queries in the same encryption used for all HTTPS traffic.
CISA's Protective DNS service secures an average of 1.6 billion DNS queries daily across federal agencies while maintaining a 99.999% resolver uptime rate (CISA, 2024). The federal mandate to encrypt DNS traffic (OMB M-22-09) and NIST's updated guidance (SP 800-81r3) both recognize encrypted DNS as a foundational zero-trust security architecture control. Organizations deploying DoH gain protection against DNS surveillance and manipulation while facing new challenges around network visibility, policy enforcement through security information and event management, and enterprise DNS architecture compatibility.
DNS over HTTPS (DoH) vs. DNS over TLS (DoT)
| Aspect | DNS over HTTPS (DoH) | DNS over TLS (DoT) |
| Primary function | Encrypts DNS queries using HTTPS protocol | Encrypts DNS queries using TLS protocol |
| Port used | Port 443 (standard HTTPS) | Port 853 (dedicated DNS encryption) |
| Network visibility | Blends into HTTPS traffic, hard to identify | Easy to identify and manage via port filtering |
| Used by | Browsers (Firefox, Chrome), privacy-focused clients | Enterprise DNS infrastructure, managed resolvers |
| When to use | Individual privacy, bypassing DNS monitoring | Enterprise environments requiring DNS traffic visibility |
The key difference is network manageability. DoT uses dedicated port 853, making it easy for administrators to monitor and control encrypted DNS traffic, while DoH deliberately blends into port 443 HTTPS traffic to prevent identification and blocking.
Common Misconceptions
DNS over HTTPS does not make DNS queries completely anonymous. The DoH resolver operator can always see the full query traffic, it just shifts trust from the ISP to the resolver provider.
DoH does not replace DNSSEC. DoH encrypts the transport channel between client and resolver, while DNSSEC validates that DNS responses are authentic and haven't been tampered with. They serve complementary purposes and can be deployed together.
Frequently Asked Questions
DoT uses dedicated port 853, making it easy for network administrators to identify, monitor, and control encrypted DNS traffic through firewall rules. DoH uses port 443 and blends into HTTPS traffic, making it harder to detect but also harder to manage in enterprise environments where visibility and policy enforcement matter.
Browser-enabled DoH bypasses network-level DNS filtering, content controls, and threat protection by routing queries to external resolvers instead of corporate DNS infrastructure. Organizations can maintain security by deploying managed DoH-aware endpoints, running internal DoH resolvers, or blocking external DoH traffic at the firewall while providing encrypted DNS through approved channels that support network infrastructure management requirements.
Windows Server DNS doesn't support DoH queries, and Active Directory relies heavily on DNS for domain controller discovery, authentication, and service location. Enabling DoH breaks these critical domain services because DoH is designed for client-to-resolver communication, not the server-to-server DNS infrastructure that enterprise networks depend on.
