DNS over HTTPS (DoH, RFC 8484) wraps DNS queries and answers in HTTPS requests to a resolver, usually on port 443. Classic DNS is plain text over UDP or TCP port 53, so anyone on the path can read or tamper with it. DoH encrypts the exchange between the client and the resolver.
Why it matters
It protects the privacy and integrity of lookups on untrusted networks such as public Wi-Fi. Browsers can enable it independently of the operating system, which also means a browser may bypass the DNS servers your network configured, breaking internal names or content filtering. Note that DoH hides queries only from the network path. The resolver operator still sees every name you ask for.
Example
A JSON-style query to a public resolver:
curl -H 'accept: application/dns-json' \
'https://cloudflare-dns.com/dns-query?name=example.com&type=A'The standard wire format uses the media type application/dns-message. Other providers, such as Google, offer their own endpoints.
Common mistakes
- Assuming DoH makes you anonymous. The resolver and the destination site still see you.
- Enabling it in a browser and then wondering why internal hostnames stop resolving.
- Treating DoH as a replacement for DNSSEC. DoH secures the transport, not the origin of the data.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.