What Is DoH? Security Definition

Imagine you live in a small town where everyone knows each other, and when you ask for directions to a friend's house, you shout the address across the street. Anyone passing by can hear where you're going, and a troublemaker could even yell back a fake address to send you somewhere else. DoH is like calling that friend on a private, encrypted phone line instead of shouting.

You dial a secure number, whisper the address, and only your friend hears it. Even if someone is listening on the line, they only hear garbled noise. This way, your destination stays private, and you can be sure the directions you receive are genuine.

DoH turns public, shouty DNS queries into private, secure phone calls.

DNS over HTTPS (DoH) is a network protocol defined in RFC 8484 (November 2018) that encodes DNS queries and responses in HTTP messages over TLS (HTTPS). It operates at the Application Layer (Layer 7) of the OSI model, using the existing HTTPS infrastructure. Mechanically, a DoH client (e.

g., a browser or OS resolver) sends an HTTP POST or GET request to a DoH server endpoint (e.g., https://dns.cloudflare.com/dns-query). The DNS message is placed in the HTTP body (for POST) or encoded as a base64url parameter (for GET).

The Content-Type is application/dns-message. The server responds with the DNS response in the HTTP response body. The entire exchange is encrypted by TLS, typically on TCP port 443.

This contrasts with traditional DNS, which uses UDP port 53 (or TCP for large responses) without encryption. DoH provides confidentiality (no third party can see the query), integrity (response cannot be tampered without detection), and authentication (server identity is verified via TLS certificates). However, DoH does not encrypt the destination IP address of the DoH server itself, nor the SNI (Server Name Indication) field in the TLS handshake, so some metadata may still leak.

Alternatives include DNS over TLS (DoT, RFC 7858) which uses a dedicated port (853) and is easier to block, and DNSCrypt (not an IETF standard). DoH is often used alongside DNSSEC for end-to-end validation, though DoH alone does not provide data origin authentication.

DoH matters because it fundamentally changes the security and privacy landscape of DNS, which is a core network service. IT professionals must understand DoH to troubleshoot connectivity issues (e.g.

, when a firewall blocks port 443 to external resolvers), to configure network policies (e.g., allow or block DoH), and to maintain visibility for security monitoring. Without this knowledge, an admin might be puzzled why DNS filtering stops working or why users can bypass content restrictions.

In exams, DoH appears as a contrast to traditional DNS and DoT, testing your grasp of encryption, ports, and privacy implications. Mastering DoH demonstrates a modern understanding of network security and prepares you for real-world scenarios where users and applications increasingly adopt encrypted DNS.

A common question pattern is: 'Which of the following protocols encrypts DNS queries using HTTPS?' The correct answer is DoH, with distractors like DoT (uses TLS but on port 853), DNSSEC (signs responses but doesn't encrypt), or IPsec (encrypts at a different layer). Another pattern: 'A network administrator notices that DNS filtering is no longer working.

Users can still access the internet. What is the most likely cause?' The answer is that users have enabled DoH in their browsers, bypassing the local DNS server. Wrong answers might include 'DNS cache poisoning' or 'DNSSEC validation failure.'

A third pattern: 'Which port does DNS over HTTPS use?' Options include 53, 443, 853, and 80. The correct answer is 443. A fourth pattern: 'Which of the following best describes the security benefit of DoH compared to traditional DNS?'

Correct answer: 'It encrypts the DNS query and response.' Wrong answers: 'It authenticates the DNS server' (that's DNSSEC) or 'It hides the destination IP address' (it doesn't).

DNS over HTTPS (DoH) is a protocol that encrypts DNS queries by sending them over HTTPS. The core concept is to protect user privacy and prevent tampering. How it works: A DoH client (browser, OS, or stub resolver) sends DNS queries as HTTP requests to a DoH-compatible server.

The server responds with DNS answers in HTTP responses. All communication is encrypted with TLS, typically on port 443. This makes DoH traffic look like regular web traffic, making it difficult to block or filter.

Comparison to similar technologies: DNS over TLS (DoT) also encrypts DNS but uses a dedicated port (853), making it easier to identify and block. DNSSEC adds digital signatures to DNS responses but does not encrypt queries. Traditional DNS uses plaintext UDP on port 53, offering no privacy.

Configuration: In Firefox, DoH can be enabled in Settings > Network Settings > Enable DNS over HTTPS. Choose a provider (e.g., Cloudflare, NextDNS). In Windows 11, DoH can be configured in network adapter settings.

For enterprise networks, administrators may want to disable DoH to maintain DNS visibility, using group policies or firewall rules to block outbound port 443 to known DoH resolvers. Key takeaway: DoH enhances privacy but reduces network administrators' ability to monitor and filter DNS traffic. On exams, remember that DoH uses port 443, is defined in RFC 8484, and is an application-layer protocol.

It does not encrypt the destination IP or SNI, so it is not a complete privacy solution.