Glossary

DNS over HTTPS (DoH)

Encrypts DNS queries inside HTTPS to protect user privacy

DNS over HTTPS (DoH) is a protocol defined in RFC 8484 that sends DNS queries and responses encrypted within HTTPS connections, preventing network observers from seeing which domains a user is looking up and protecting against tampering with DNS responses.

What is DNS over HTTPS?

DNS over HTTPS, commonly abbreviated as DoH, is a protocol standardised in RFC 8484 that encapsulates DNS queries within HTTPS connections. Traditional DNS queries are sent in plaintext over UDP or TCP on port 53, meaning anyone who can observe network traffic — including ISPs, network administrators, or attackers on a public Wi-Fi network — can see exactly which domains a user is querying.

DoH addresses this privacy gap by wrapping DNS queries in standard HTTPS requests sent to a DoH-capable resolver endpoint (typically at a URL such as "https://cloudflare-dns.com/dns-query"). Because the traffic is indistinguishable from ordinary HTTPS web traffic and is encrypted end-to-end with TLS, network observers can see only the IP address of the DoH server, not the individual domain queries.

DoH is supported natively in modern browsers (Firefox, Chrome, Edge), operating systems, and dedicated DNS applications.

How Does DoH Work?

When a DoH-enabled client needs to resolve a domain, instead of sending a UDP packet to port 53, it sends an HTTPS GET or POST request to a DoH resolver endpoint. The DNS query is encoded in wire format and either passed as a URL parameter (for GET requests) or included in the request body (for POST requests) using the content type "application/dns-message."

The DoH resolver processes the query like any recursive resolver — querying authoritative servers and returning the result — then sends the DNS response back as an HTTPS response body. The entire exchange is encrypted using TLS, and the TLS certificate of the DoH endpoint provides authentication, preventing man-in-the-middle attacks.

Because DoH traffic uses port 443 and looks identical to regular HTTPS traffic, it is difficult to block at the network level without disrupting all HTTPS traffic. This has made DoH both popular with privacy advocates and controversial in enterprise environments where DNS monitoring is used for security purposes.

How to Use DNS over HTTPS

You can perform DNS lookups that simulate a DoH query using the DNS Lookup tool at nslookup.net/tools/dns-lookup. To enable DoH system-wide, you can configure it in your browser's settings, in your operating system's network configuration (available in Windows 11 and macOS Ventura and later), or by using a DoH-capable resolver application.

Popular public DoH endpoints include Cloudflare (https://1.1.1.1/dns-query), Google (https://dns.google/dns-query), and NextDNS.

Related Tool

DNS Lookup

Try the Tool →

Frequently Asked Questions

What is the difference between DoH and DoT (DNS over TLS)?

Both DoH and DoT (DNS over TLS, RFC 7858) encrypt DNS traffic to protect privacy. DoT uses a dedicated port (853) and a direct TLS connection, making it easier to identify and potentially block at the network level. DoH uses port 443 and HTTPS, making it harder to distinguish from regular web traffic. DoT is preferred in some enterprise environments because it is easier to monitor and manage, while DoH is preferred for consumer privacy.

Does DoH replace DNSSEC?

No. DoH and DNSSEC solve different problems. DoH encrypts the channel between the client and the recursive resolver, protecting queries from network observers. DNSSEC validates the authenticity and integrity of the DNS data itself by verifying cryptographic signatures from authoritative nameservers. Both can and should be used together for comprehensive DNS security.

Can DoH be blocked by a network administrator?

Because DoH traffic uses port 443 and resembles regular HTTPS, blocking it without disrupting all HTTPS traffic is difficult at the packet level. However, network administrators can block known DoH resolver IP addresses or use DNS-based blocking to prevent DoH configuration. Some operating systems and enterprise management platforms allow administrators to disable DoH for managed devices.

Is DoH available on mobile devices?

Yes. DoH is supported on Android (via Private DNS settings, which use DoT but are conceptually similar) and iOS/macOS through configuration profiles or apps. The Firefox and Chrome browsers on mobile platforms support DoH through their browser-level DNS settings. Apps like Cloudflare's 1.1.1.1 and NextDNS provide system-wide DoH/DoT on mobile without requiring root access.