What DNS over HTTPS is

DNS over HTTPS (DoH) is a way to send DNS queries (the lookups that turn names into IP addresses) through an HTTPS connection. The intent is to make the DNS request content harder to read or tamper with by someone who can observe network traffic between your device and the resolver.

In a typical DNS setup without DoH, DNS queries are sent using DNS over UDP/TCP to a resolver. Those queries can be visible to observers on the path. With DoH, the DNS queries are transported inside HTTPS, which uses encryption and authentication properties provided by TLS.

How DoH works in practice

  1. Your device or browser prepares a DNS query (for example, mapping a domain name to an IP address).
  2. Instead of sending that query using plain DNS on the network, the client sends it to a resolver using HTTPS.
  3. The resolver processes the request and returns the answer over the same HTTPS channel.

Because the DNS messages are carried within HTTPS, an on-path observer is generally less able to directly inspect the DNS query and response contents.

What DoH changes—and what it doesn’t

DoH can improve protection of DNS query contents against simple network inspection. However, it does not automatically provide “full anonymity” or remove every possible privacy risk. Several practical limitations matter:

  • Visibility can shift, not disappear. Your resolver choice (the service that receives the DoH queries) still sees the queries. If you use a resolver operated by a third party, that party may log requests depending on its policies.
  • Metadata and traffic patterns remain. Even with encryption, observers may still infer that DNS-like HTTPS traffic is happening, and correlate it with browsing activity patterns.
  • It doesn’t stop DNS-based blocking by itself. If a network or security system blocks access to the DoH resolver endpoint, or uses other enforcement mechanisms, name resolution may still fail or be affected.
  • It may not cover every path. Some devices or applications may use system DNS, while others may implement their own resolution behavior. The end result depends on your OS/browser configuration.

When people talk about “DNS leaks,” they usually mean that queries meant to be handled via a privacy-oriented mechanism still end up being resolved through another path—most commonly because of configuration gaps, browser/OS differences, or fallback behaviors.

A practical way to think about it is: DoH is one mechanism for transporting queries securely to a resolver, but you can still end up with mixed behavior if other DNS resolution paths are in use.

Differences to know: DoH vs. DoT and “system DNS”

  • DoH (DNS over HTTPS) uses HTTPS as the transport.
  • DoT (DNS over TLS) uses TLS directly for DNS.
  • System DNS (traditional) uses DNS over UDP/TCP to the configured resolver.

Which one is used depends on client support and configuration. Some environments enable one method for browsers, but not for all applications.

Practical checks you can do

Because behavior varies by client and configuration, focus on checks that answer two questions: (1) are DNS queries being sent over HTTPS, and (2) are there unexpected alternate resolution paths.

Check 1: Confirm the setting

Look in your browser DNS settings and your operating system privacy/network settings for any option related to “Secure DNS,” “DNS over HTTPS,” or a specific DoH provider. If a feature is off, DoH usually won’t be used for that client.

Check 2: Observe where name resolution goes

If DoH is active, DNS lookups should not appear as plain DNS traffic to the traditional UDP/TCP resolver on your local network. You can use network monitoring tools to inspect traffic patterns—though exact visibility depends on your environment and encryption.

Check 3: Detect mismatches (possible leaks)

After enabling DoH, test multiple domains and compare results across:

  • the browser you configured
  • other apps that may use their own DNS stack

If one application still resolves names using traditional DNS, you may have incomplete coverage.

Check 4: Test reachability to the DoH resolver

If name resolution fails when DoH is enabled, it can indicate that the resolver endpoint is blocked or unreachable from your network. You can try toggling DoH on and off to confirm whether failures track with the setting.

Clear boundaries to avoid misunderstandings

  • DoH is primarily about transporting DNS queries securely to a resolver.
  • It does not automatically guarantee that the resolver operator cannot log requests.
  • It does not guarantee that every device and application will use DoH consistently.
  • It doesn’t remove the need for standard security controls (firewalls, malware protection, safe browsing practices), because DNS is only one part of how connections are established.

Bottom line

DNS over HTTPS encrypts DNS query traffic inside HTTPS, which can make DNS lookups less readable to observers on the network path. The main limitations are that your queries are still handled by a resolver, traffic patterns and metadata may still be inferable, and not all applications may use DoH consistently. You can validate your setup by checking secure DNS settings and verifying whether DNS behavior changes as expected.