What Is DNS over HTTPS? Security Definition

Imagine you are sending a letter through the postal service. In the old way, your letter is in a clear envelope, so any postal worker, nosey neighbor, or even a thief along the route can read the address and see where you are sending it. They could even change the address on the envelope to send your letter to a different house. That is how traditional DNS works. Your device sends a request to a DNS server asking for the IP address of a website like www.example.com, and that request is sent in plain text over the network. Anyone on that network can see which websites you are visiting, and a malicious actor could redirect your request to a fake website.

Now, with DNS over HTTPS, the request is put inside a sealed envelope. That sealed envelope is the encryption provided by HTTPS, the same technology that protects your online banking and shopping. Your DNS query is sent securely to the DNS server, and the response comes back encrypted as well. This means your internet service provider, a hacker on a public Wi-Fi network, or anyone else cannot see which websites you are trying to visit. They cannot modify your request either. DoH is like sending your letter in a locked, armored box that only the recipient can open. It ensures privacy and integrity for one of the most fundamental services on the internet.

Think of DNS as the phonebook of the internet. When you want to call a friend, you look up their number in the phonebook. But if someone else looks over your shoulder and sees which number you are calling, they know who you are contacting. With DoH, you are using a private phonebook that only you can see. The request is encrypted from the moment it leaves your device until it reaches the secure DNS resolver, and the response is encrypted on its way back. This is a simple but powerful tool for protecting your online privacy.

DNS over HTTPS (DoH) is a network protocol defined in RFC 8484 that performs DNS resolution via the HTTPS protocol. Traditionally, DNS queries are sent over UDP or TCP on port 53 without encryption, making them vulnerable to eavesdropping and DNS spoofing. DoH encrypts the entire DNS query and response within an HTTPS session, typically using TLS over port 443. This means the DNS traffic looks like regular web traffic to network observers.

From a technical perspective, a DoH client (such as a web browser or operating system) sends a DNS query as an HTTP POST or GET request to a DoH-compatible DNS resolver. The query is formatted according to the DNS wire format and is included in the HTTP request body. The server responds with a DNS response in the same wire format, wrapped in an HTTP response. This exchange occurs over a TLS-encrypted connection, ensuring confidentiality and integrity.

DoH can be implemented at the application level, for example within a web browser like Firefox or Chrome. These browsers can be configured to use a specific DoH resolver, such as Cloudflare's 1.1.1.1 or Google's 8.8.8.8. This bypasses the system's default DNS resolver, which may be provided by the ISP or local network. System-wide DoH implementation is also possible through certain operating system configurations or third-party software.

The use of standard HTTPS port 443 means DoH is often difficult to block or monitor using traditional network filtering tools, because it blends in with other web traffic. This has implications for network security monitoring and content filtering policies in enterprise environments. Some organizations prefer DNS over TLS (RFC 7858), which uses a dedicated port (853) and is easier to manage centrally.

DoH does not change the underlying DNS resolution process. It still uses the same hierarchical DNS infrastructure, root servers, TLD servers, and authoritative nameservers. The encryption only applies to the communication between the client and the recursive resolver. The recursive resolver still communicates with authoritative servers in plain text unless they also support encryption. This is an important point: DoH protects your privacy from your local network and ISP, but does not encrypt the entire DNS lookup chain from end to end.

DNS over HTTPS matters because it addresses a fundamental privacy and security flaw in the original DNS protocol. Every time you visit a website, your device sends a DNS query. Without encryption, those queries are sent in plain text across the network. Your internet service provider can log every site you visit. On public Wi-Fi, a hacker can capture your DNS traffic and see your browsing history. Worse, an attacker could perform DNS spoofing, where they intercept your query and send back a fake IP address, redirecting you to a malicious website that looks like your bank or email provider.

For IT professionals, deploying DoH is a straightforward way to enhance user privacy and security. In corporate environments, however, DoH can create challenges for DNS-level security policies. Many organizations use DNS filtering to block access to malicious domains. If employees use browsers with DoH enabled and set to external resolvers, they bypass these corporate DNS filters. This is why network administrators need to understand DoH and manage it appropriately, either by blocking DoH traffic or by deploying a corporate DoH resolver that integrates with existing security infrastructure.

From a system administration perspective, DoH is increasingly supported by major operating systems and browsers. Windows 10 and 11 allow system-wide DoH configuration. Browsers like Firefox and Chrome have built-in DoH features. As more devices adopt DoH, understanding how it works and how to configure it becomes essential for troubleshooting network connectivity and security issues. It also impacts network monitoring tools that rely on DNS traffic analysis, as encrypted DNS traffic is no longer visible in the same way.

In certification exams, DNS over HTTPS appears mostly in scenario-based and conceptual questions. You might see a scenario where a user is on a public Wi-Fi network and is concerned about someone intercepting their DNS traffic. The question asks what protocol could be used to encrypt DNS queries. The correct answer would be DNS over HTTPS or DNS over TLS, depending on the specific details given.

Another common question pattern involves network monitoring. A network administrator notices that DNS traffic is no longer visible in their logs even though users are still accessing websites. The question asks why this might happen. The answer could be that users have enabled DNS over HTTPS in their browsers, encrypting the DNS queries and preventing the network monitoring tool from reading them.

Configuration questions may ask you to identify which port DoH uses. For example, the question might list several ports and ask which one is used by DNS over HTTPS. The correct answer is port 443. You may also be asked to compare DoH and DoT, either by identifying their port numbers or by explaining the key difference regarding how they handle traffic visibility on the network.

Troubleshooting questions might involve a user who cannot access certain websites after enabling DoH. The question could ask you to identify the problem, such as a misconfigured DoH resolver or a firewall blocking HTTPS connections to external DNS providers. You would need to understand that some networks block all external DNS traffic to enforce their own DNS policies, and DoH can bypass this, leading to connectivity issues.

DNS over HTTPS is a practical tool that IT professionals must understand for both security and troubleshooting. To configure DoH on a Windows 10 or 11 system, go to Settings, then Network and Internet, then Ethernet or Wi-Fi, and click Properties. Under DNS server assignment, click Edit, choose Manual, and enable IPv4. Enter a preferred DNS server like 1.1.1.1 and specify that you want to use encrypted DNS with a template like 1.1.1.1. On a web browser like Firefox, you can enable DoH in the Network Settings area by selecting 'Increase Tracking Protection' and using Cloudflare or a custom provider.

In practice, what can go wrong? If a network enforces DNS filtering through a local DNS server, enabling DoH in browsers can bypass those filters. This is a common issue in schools and businesses. A user might complain that they cannot access a website, but the real issue is that their browser's DoH is sending queries to an external resolver that is blocked by the firewall. The solution is either to disable DoH in the browser or to set up a corporate DoH resolver that enforces the same security policies.

Another practical consideration is network monitoring. Many security tools rely on analyzing DNS traffic to detect malware, botnets, and phishing attempts. DoH hides this traffic from those tools, so security teams need to implement alternative monitoring methods, such as inspecting HTTPS traffic with a proxy or using TLS interception. This is a significant operational challenge in enterprise environments.

For professionals studying for Network+ or Security+ exams, remember that DoH is one of several methods to secure DNS. Compare it with DoT and DNSSEC. Understand the tradeoffs: DoH provides privacy but complicates network management; DoT is easier to filter but more visible; DNSSEC provides integrity but not privacy. Being able to recommend the right solution for a given scenario is a key skill tested on certifications. Also, be aware that DoH is increasingly adopted by major platforms, so it is no longer an edge case but a mainstream technology.