DNS over HTTPS (DoH) encrypts DNS queries by tunneling them through HTTPS, preventing network operators, ISPs, and eavesdroppers from seeing which domains you request.
With traditional DNS, queries travel as plaintext UDP packets. Anyone on your network path—your ISP, WiFi router, or network admin—can see every domain you visit. DoH wraps DNS queries inside encrypted HTTPS traffic, the same protocol that secures websites. Your resolver endpoint appears as a regular HTTPS connection, making DNS lookups indistinguishable from web browsing.
DoH clients (built into modern browsers like Firefox, Chrome, and Edge) automatically redirect DNS queries to a DoH resolver—typically your ISP's resolver, a public one like 1.1.1.1, or a privacy-focused alternative. The query is encrypted end-to-end until it reaches the resolver.
How it works:
- Browser sends encrypted DNS query via HTTPS to a DoH resolver
- Resolver decrypts, performs standard DNS lookup
- Response is encrypted and returned over HTTPS
- Browser decrypts and uses the answer
Example: Instead of a plaintext UDP request for example.com, the query is POST-ed to https://resolver.example.com/dns-query with the DNS request base64-encoded inside.
DoH complements but differs from DNSSEC, which validates DNS answer authenticity, not privacy. It also works independently of TLS Handshake, though both use HTTPS infrastructure.
TipDoH can hide DNS from network administrators but not from your DoH resolver provider or your ISP (they see HTTPS traffic to the resolver). For maximum privacy, use a resolver you trust.