What Is DNS over HTTPS? – Definition and How It Works
Learn what DoH is, how it differs from DoT and plain DNS, and what it changes for privacy, filtering, and debugging.
DNS over HTTPS sends DNS queries inside an encrypted HTTPS connection to a resolver, instead of as plaintext UDP. Queries become indistinguishable from ordinary web traffic.
1. What It Changes
Plain DNS is unencrypted and unauthenticated on UDP port 53. Anyone on the path can read every name you look up, and can modify the answers.
DoH encrypts the query and authenticates the resolver, so a network observer sees an HTTPS connection to a resolver and nothing about which names were requested.
2. DoH Versus DoT
| DoH | DoT | |
|---|---|---|
| Transport | HTTPS, port 443 | TLS, port 853 |
| Distinguishable on the network | No | Yes, by port |
| Blockable by port | No | Yes |
| Typical user | Browsers, applications | Operating systems, networks |
| Administrator visibility | None | Which clients use it |
They provide the same privacy guarantee against an on-path observer. The difference is administrative: DoT is identifiable and controllable by a network operator, while DoH is not — which is precisely why DoH is contentious.
3. Application-Level Resolution
The consequential architectural change is that DoH is often implemented inside an application rather than in the operating system.
A browser with DoH enabled resolves names itself, bypassing the system resolver entirely. That means the system's DNS configuration, its cache, its hosts file, and any network-level filtering do not apply to that traffic.
The practical implication for automation: the DNS settings you configured may not be the ones the browser is using.
4. Consequences for Debugging
Standard DNS diagnosis stops working when DoH is in play:
digandnslookupquery the system resolver, not the browser's.- A hosts-file entry does not affect a DoH-resolving application.
- Packet capture on port 53 shows nothing.
- A local DNS override for testing is silently ignored.
The fix in a browser-automation context is to disable DoH explicitly so resolution goes through the system resolver you control:
browser = playwright.chromium.launch(args=[
"--disable-features=DnsOverHttps",
])
Without that, a name-resolution problem is genuinely hard to see.
5. What It Does and Does Not Hide
Hides: the names you query, from anyone on the network path other than the resolver.
Does not hide: which sites you visit. The subsequent TLS connection reveals the destination address, and the Server Name Indication field carries the hostname in plaintext unless encrypted SNI is in use.
So DoH is a meaningful privacy improvement and not anonymity. Anyone claiming it conceals browsing is overstating it.
Moves trust to the resolver operator, who now sees every query and knows who made it. Choosing a DoH provider is choosing who gets that log.
6. Relevance to Collection Work
Consistency. A client claiming to be a browser while resolving through a system resolver differs from a real browser in that respect. Whether anyone checks is another matter, but the inconsistency exists.
Split-horizon DNS. Where a target serves different addresses by resolver location, the resolver used changes which servers you reach — and a DoH resolver's location may not match your egress.
Proxy interaction. With an HTTP proxy, resolution normally happens at the proxy. A client doing its own DoH resolution may resolve locally and then ask the proxy for an address, which changes both the geography and the answer.
That last case is a real source of confusing results: locally resolved addresses reached through a distant proxy.
7. Summary
DNS over HTTPS encrypts DNS queries inside HTTPS on port 443, hiding them from on-path observers and making them indistinguishable from web traffic — unlike DoT, which is identifiable by port and controllable by a network operator.
Its most important practical effect is that applications resolve names themselves, bypassing system DNS, caches, hosts files, and packet capture — so disable it in automated browsers when you need resolution to follow the configuration you control.