---
title: "DoH"
description: "DoH tunnels DNS queries inside encrypted HTTPS traffic, hiding them from network observers. See how it works, how it differs from DoT, and its trade-offs."
url: "https://nodea.io/en/glossary/dns-over-https"
lang: "en"
updated: "2026-07-13"
---

# DoH

> DoH (DNS over HTTPS) is a protocol that carries DNS queries inside an encrypted HTTPS connection, hiding them from network operators and on-path attackers.

**DoH** (*DNS over HTTPS*, RFC 8484) is a protocol that transports [DNS](https://nodea.io/en/glossary/dns) queries and responses inside an ordinary encrypted [HTTPS](https://nodea.io/en/glossary/https) connection. Traditional DNS travels in plain text, so anyone on the path — the ISP, a Wi-Fi operator, an attacker in a café — can read which domains you visit and even forge the answers. With DoH, lookups are indistinguishable from regular web traffic on port 443.

## How DNS over HTTPS works

The client (a browser or the operating system) opens an HTTPS session to a DoH-capable resolver — for example *https://cloudflare-dns.com/dns-query* — and sends the DNS query as an HTTP request: either GET with a base64url-encoded payload or POST with the binary message body (*application/dns-message*). The answer returns over the same encrypted channel. The practical effects:

- **Confidentiality** — on-path observers cannot read queries or responses.
- **Transport integrity** — tampering with answers in flight would require breaking TLS; authenticity of the zone data itself is the complementary job of [DNSSEC](https://nodea.io/en/glossary/dnssec).
- **Shifted trust** — your lookup history is now visible to the DoH resolver operator instead of the ISP, so the provider's privacy policy matters.

## DoH in practice

Support is now universal: Firefox, Chrome and Edge expose it as "secure DNS", while Windows 11, macOS, iOS and Android can enable it system-wide. Popular public resolvers include Cloudflare (1.1.1.1), Google (8.8.8.8) and Quad9 (9.9.9.9, which additionally blocks known-malicious domains). Common motivations: protecting lookups on open Wi-Fi, bypassing ISP-level DNS manipulation, and hardening DNS-based content filtering against downgrade.

In managed networks DoH cuts both ways. Because it hides DNS inside web traffic, employees or malware can bypass internal filters and split-horizon DNS, so administrators commonly disable in-browser DoH via policy, block known DoH endpoints, and offer an approved encrypted resolver — often [DoT](https://nodea.io/en/glossary/dns-over-tls) — at the network edge instead. Note that DoH is not an anonymity tool: destination IPs and TLS metadata still reveal a great deal, which is where a [VPN](https://nodea.io/en/glossary/vpn) differs.

### Should I use DoH or DoT?

Both encrypt DNS with TLS. DoT runs on its own port 853, so network admins can see and manage it — the usual choice in corporate networks. DoH blends into regular HTTPS on port 443, making it nearly impossible to block selectively, which favours personal privacy but frustrates enterprise policy enforcement.

## Related

- [DNS](https://nodea.io/en/glossary/dns)
- [DoT (DNS over TLS)](https://nodea.io/en/glossary/dns-over-tls)
- [HTTPS](https://nodea.io/en/glossary/https)
- [DNSSEC](https://nodea.io/en/glossary/dnssec)
- [VPN](https://nodea.io/en/glossary/vpn)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/doh.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)