DNS over HTTPS (DoH) is a protocol that sends DNS queries and responses inside encrypted HTTPS connections, hiding them from eavesdroppers and preventing tampering on the network path.
How DNS over HTTPS works
Traditional DNS queries travel in plain text on port 53, so anyone on the network can see which domains a user visits and alter the answers. DoH, standardised in RFC 8484 (2018), wraps DNS messages in HTTPS requests to a resolver, usually on port 443, where they blend in with ordinary web traffic. A related protocol, DNS over TLS (DoT, RFC 7858), encrypts DNS with TLS on a dedicated port 853, which is easier for network administrators to identify.
Firefox began enabling DoH by default for US users in 2020, and Chrome, Edge, Android and Windows 11 also support encrypted DNS. Public resolvers such as Cloudflare, Google and Quad9 offer DoH endpoints.
Why DoH matters for security
For users, DoH protects privacy on public Wi-Fi and makes DNS-based censorship and spoofing harder. For organisations, it is a double-edged sword:
- Visibility loss – browsers that use an external DoH resolver bypass corporate DNS filtering, logging and protective DNS services.
- Malware abuse – the Godlua backdoor, found in 2019, was one of the first known malware families to use DoH to hide its command and control lookups, and the Iranian group OilRig (APT34) used DoH-based tunnelling for data exfiltration.
- Harder detection – DNS tunnelling inside HTTPS cannot be inspected without TLS interception.
Best practices
- In companies, provide an internal DoH or DoT resolver and enforce it through browser and OS policies.
- Block known public DoH resolvers at the firewall where policy requires DNS visibility.
- Firefox respects the canary domain use-application-dns.net, which networks can use to disable automatic DoH.
- At home, choose a trustworthy resolver, ideally one that filters malicious domains.
