The Off-Key Bard
Technology

What Is DNS Over HTTPS, and Why Does It Matter?

Or: the website is encrypted, so why are you announcing where you're going? HTTPS protects what you say. DNS over HTTPS protects your request for directions.

Or: The Website Is Encrypted — So Why Are You Announcing Where You're Going?

We've talked before about DNS — the Domain Name System — and its essential, unglamorous job. You type example.com, your computer needs an IP address, and DNS provides it.

It's one of those pieces of internet plumbing that works so quietly most people never think about it. But traditional DNS has a privacy problem that's easy to miss: you can connect to a website over HTTPS with your traffic beautifully encrypted, and immediately before making that secure connection, your computer asks — often in plaintext visible to your local network — "where can I find example.com?"

That gap is what DNS over HTTPS, usually abbreviated DoH, is designed to close.

The Privacy Gap Traditional DNS Leaves Open

The internet's core protocols were built decades ago for a much smaller, trust-based network. Security and privacy features that seem obvious today weren't part of every original protocol.

Traditional DNS queries were designed to be simple and fast, not confidential. A DNS lookup might travel across your local network and through your ISP unencrypted, letting anyone positioned along that path see the domain name you requested. Not the specific page — DNS typically deals in domain names rather than full URLs — but the domain itself.

Domain names alone reveal more than you might expect. If your device looks up a bank, a medical provider, a legal service, a political organization, or a dating site, those names form a picture of your activity. Nobody needs to read your actual communications to learn something from the destinations you're requesting.

This creates a situation where the conversation itself is protected but the request for directions isn't. Think of visiting a specialist clinic. Nobody follows you inside, and your appointment is private. But before leaving home, you call a public directory service and loudly ask for the clinic's address — and the next day, the address of a bankruptcy lawyer. And the day after that, an addiction support center. Nobody needs to hear your private conversations to infer something from the destinations you requested.

What DNS Over HTTPS Actually Does

The idea is straightforward. Instead of sending a traditional DNS query directly over the network, DoH sends DNS requests through an encrypted HTTPS connection to a compatible DNS resolver. The DNS traffic receives the same confidentiality and integrity protections HTTPS provides for web browsing.

Where traditional DNS looks like:

Computer → "Where is example.com?" → DNS resolver (visible to network)

DoH looks like:

Computer → encrypted HTTPS connection → DNS resolver (contents hidden from network)

The network carrying the connection can see that you're communicating with a DNS resolver. It doesn't see the specific query inside the encrypted tunnel. The request for directions goes inside a sealed envelope instead of being announced out loud.

The Resolver Still Receives the Question

Here's the part privacy discussions often gloss over. DoH doesn't make the DNS request invisible to everyone — it protects it between your device and the resolver. The resolver has to answer the question, which means at some point it needs to know what you asked.

DoH primarily changes who can see the query. It reduces visibility to your local network and ISP while concentrating it at the resolver you chose. This is the same pattern we saw with VPNs: privacy technologies don't make information disappear, they change who gets to see it.

Which means choosing a DNS resolver is also choosing a trusted intermediary. The useful questions to ask about any DoH provider aren't just about performance — they're about what the resolver logs, how long it retains data, whether it links queries to identities, and what its business model is. Technology can encrypt the road. It can't decide which destination deserves your trust.

DoH vs. DoT: A Brief Distinction

You may also encounter DNS over TLS (DoT), which encrypts DNS queries using TLS over a dedicated port (853) rather than wrapping them inside HTTPS (port 443).

Both achieve similar privacy goals for DNS. The practical difference is visibility: DoT uses a dedicated port that's easy for network administrators to identify and either allow or block. DoH uses the same port as ordinary HTTPS traffic, making it much harder to distinguish from regular encrypted web browsing. From a user privacy standpoint DoH is generally harder to filter or block, which is part of why it's been more widely adopted in consumer browsers — and why it's also more controversial in managed network environments.

The Network Administrator's Problem

Privacy that's a feature for individual users can look like a security blind spot to an organization managing a network.

Organizations routinely use DNS at their network perimeter for legitimate purposes: blocking known malicious domains before connections are established, enforcing content policies in schools or workplaces, implementing parental controls on home networks, and resolving internal names that only exist within the private network. When an application bypasses the local network's DNS by using an external DoH resolver, it can bypass those controls entirely.

Neither side is wrong. The individual user wants private browsing history. The school wants to enforce content filtering. The IT team wants to block command-and-control infrastructure used by malware. DoH makes those goals harder to reconcile simultaneously, which is why it's been the subject of genuine debate rather than universal adoption. Mozilla allows organizations to disable DoH enterprise-wide through policies, and browsers generally respect these configurations.

What DoH Does and Doesn't Protect

What it protects against:

  • Eavesdropping on DNS queries by the local network, your router, or others on shared Wi-Fi
  • ISPs observing and potentially logging DNS-level domain requests
  • Tampering or spoofing of DNS responses in transit

What it doesn't protect against:

  • Destination IP addresses: after DNS provides an address, your device still connects to it. That connection has to be routed, which means the network knows where your traffic is going — though CDNs and shared infrastructure complicate this relationship.
  • Website tracking: the site you visit still sees you arrive, along with any cookies, login information, or browser fingerprinting already in play.
  • Malware: DoH will privately and efficiently help your device find a malicious website if that's what you asked for. The encryption doesn't evaluate the destination.
  • The resolver itself: you've reduced ISP visibility, but the resolver now receives every query you make.

Privacy on the modern internet isn't one open window that a single technology closes. Your browser knows some things. Your ISP knows some things. Your DNS resolver knows some things. The website you visit knows some things. DoH closes one of those windows — the one where your request for directions was announced to the local network in plaintext.

Should You Enable It?

For many ordinary users on ordinary home networks, encrypted DNS is a straightforward improvement with little downside. Most major browsers now support it and some enable it by default. The DNS resolver selection matters, but defaulting to a reputable provider is a reasonable starting point.

The exceptions are worth knowing. On a managed business or school network, DoH may interfere with intentional security controls — a good reason to understand your environment before overriding DNS configuration. On a household network using DNS-based filtering or parental controls, it may bypass those settings. With a VPN, DNS is typically already routed through the VPN's infrastructure, so additional configuration may or may not be needed depending on what the VPN client handles.

The useful framing isn't "always enable DoH everywhere." It's "understand what path your DNS takes and decide who you want to trust with that information."

The Bard's Take

For years, we got better at encrypting what we said online while still sometimes leaving the request for directions exposed. HTTPS protected the conversation. DNS often didn't protect the address lookup that came right before it.

DNS over HTTPS puts that request inside an encrypted envelope. The local network, your router, and your ISP no longer see "where is example.com?" in plaintext — they see an encrypted connection to a resolver. The resolver itself still answers the question, so the trust moves rather than disappears. But the improvement over broadcasting your destinations in plaintext is real.

Closing that one window doesn't close all the windows. The resolver still has visibility. Your ISP still routes your traffic. The website you arrive at still knows you came. Cookies don't disappear. Tracking doesn't stop.

But someone standing between you and the person giving directions no longer needs to hear you ask.

Sources

← Back to the Desk — Technology