What is DNS over HTTPS?
Updated: 3 days ago
DNS over HTTPS (DoH) is a way of carrying DNS queries and responses inside an encrypted HTTPS connection. Instead of sending a conventional DNS lookup in clear text to a resolver, a DoH client sends the DNS message to a configured DoH server over HTTPS. This protects the DNS exchange between the client and that resolver from passive observers and from straightforward tampering on the network path.
The important distinction is that DoH protects DNS transport; it does not make your whole internet connection anonymous. The DoH resolver can still process the domain names you ask it to resolve, and other information about the connections you subsequently make may remain observable. DNS over HTTPS is therefore a DNS privacy and integrity mechanism, not a replacement for HTTPS, DNSSEC or a VPN.
How does DNS over HTTPS work?
When an application needs the IP address for a domain name, a DoH-capable client creates a normal DNS query and maps that query into an HTTP exchange with a configured DoH server. RFC 8484 defines this behaviour and requires DoH servers to support both HTTP GET and POST. The HTTPS layer provides TLS confidentiality, integrity and server authentication for the client-to-resolver connection.
The application or operating system needs to resolve a domain name such as example.com.
A DoH client sends the DNS query to its configured DoH URI over HTTPS.
The DoH resolver processes the lookup, using its cache or the wider DNS hierarchy as necessary.
The resolver returns the DNS response through the encrypted HTTPS connection.
The client uses the returned address and then makes the separate application connection to the destination service.
DoH commonly uses HTTPS on TCP port 443, although the protocol is defined by the HTTPS URI rather than by a rule that every deployment must use one fixed network path. Because the DNS exchange looks like HTTPS traffic to an on-path observer, simple systems that expect to inspect conventional unencrypted DNS may no longer see the domain lookup.
Traditional DNS vs DNS over HTTPS
Traditional DNS: commonly sends queries directly over UDP or TCP, typically on port 53, without transport encryption.
DNS over HTTPS: carries DNS messages through HTTPS, protecting the client-to-DoH-resolver exchange with TLS.
DNS over TLS (DoT): also encrypts DNS, but uses a dedicated TLS transport rather than HTTP.
DNSSEC: validates the authenticity and integrity of signed DNS data; it does not encrypt the DNS transport. DNSSEC and DoH solve different problems and can be used together.
What does DNS over HTTPS protect?
DoH protects the confidentiality and integrity of DNS queries and responses while they travel between the DoH client and the selected DoH resolver. Someone merely observing that network path cannot directly read the DNS message in the way they could with conventional unencrypted DNS.
It also authenticates the DoH server through HTTPS. This makes simple on-path redirection or alteration of DNS traffic more difficult, provided the client correctly validates the HTTPS connection and is using the intended resolver.
What does DNS over HTTPS not protect?
It does not hide DNS queries from the DoH resolver itself.
It does not make browsing anonymous.
It does not encrypt traffic between your device and the destination website; HTTPS or another application protocol is responsible for that.
It does not replace DNSSEC validation of signed DNS data.
It cannot guarantee that every application on a device uses the same DNS path.
It does not prevent a destination IP address or other traffic characteristics from revealing information about the service being contacted.
DNS over HTTPS and your UK broadband provider
On a UK broadband connection, conventional DNS may be supplied automatically by the ISP through the router, DHCP or IPv6 configuration. A browser, operating system or application using its own DoH resolver can instead send selected DNS lookups through HTTPS to that resolver. The exact behaviour depends on the device, browser, resolver policy and network configuration.
DoH does not change whether the access connection is FTTP, FTTC, cable, fixed wireless or mobile broadband. The DNS request still travels over the underlying broadband connection. What changes is the transport used for the DNS exchange and potentially which resolver receives the query.
This distinction matters on managed networks. Parental controls, malware filtering, split DNS, enterprise name resolution and ISP services can depend on a particular resolver. RFC 8484 explicitly notes that different DNS servers can return different answers because of local policy and configurations such as split DNS. Changing the resolver can therefore change more than privacy.
Can your ISP still see which websites you visit with DoH?
DoH prevents an ISP or other passive observer on the client-to-resolver path from simply reading the DNS query itself. That does not mean the ISP becomes blind to all browsing activity. It still carries your IP traffic and can observe destination IP addresses, timing, traffic volumes and other connection metadata. Whether those observations identify a particular website depends on the service architecture and the protocols in use.
The privacy boundary also moves to the DoH provider. RFC 8484 warns that the HTTPS transport and server can provide correlation information. Choosing a resolver is therefore a trust decision rather than a way to eliminate trust.
Does DNS over HTTPS make DNS faster?
Not inherently. DoH adds HTTP and TLS machinery, but persistent connections, resolver caching and modern HTTP can reduce repeated setup overhead. Real-world lookup time depends on resolver location, cache state, network latency, connection reuse, server load and implementation quality. A nearby well-run DoH resolver may be faster than a poor conventional resolver, while another DoH path may be slower.
For broadband troubleshooting, avoid treating a small DNS timing difference as a broadband speed difference. DNS affects how quickly a name is resolved; it does not increase the line rate, download bandwidth or upload bandwidth of the access connection.
DoH, DoT, HTTPS and VPNs are not the same thing
DoH encrypts DNS queries between a DoH client and a DoH resolver using HTTPS.
DoT encrypts DNS queries using a dedicated TLS transport.
HTTPS protects web application traffic between the client and the HTTPS server.
A VPN creates an encrypted tunnel to a VPN endpoint and may carry DNS as part of that tunnel, depending on configuration.
DNSSEC provides origin authentication and integrity for signed DNS data rather than transport confidentiality.
Potential problems with DNS over HTTPS
DoH can conflict with networks that deliberately use local DNS behaviour. A corporate network might resolve internal hostnames that a public resolver cannot know. A household filtering service may rely on its configured DNS resolver. Captive portals and security products can also behave differently depending on how the client handles secure DNS.
The practical question is not simply whether DoH is good or bad. It is which resolver is being used, what privacy and logging policy it follows, whether the local network depends on DNS policy, and whether the client has a sensible fallback strategy.
How to troubleshoot DNS over HTTPS
Confirm whether DoH is enabled in the browser, operating system or application you are actually testing.
Identify the selected DoH resolver rather than assuming the ISP resolver is being used.
Test the same domain with DoH enabled and disabled to separate resolver behaviour from wider connectivity problems.
Check whether local hostnames, split DNS, parental controls or security filtering depend on the network's normal resolver.
If websites fail only with DoH enabled, try a different trusted DoH resolver or restore the network-provided resolver temporarily for diagnosis.
If all name resolution fails, test basic IP connectivity separately; a DNS failure and a broadband connection failure are not the same problem.
DNS over HTTPS FAQs
Is DNS over HTTPS the same as HTTPS?
No. DoH uses HTTPS as the transport for DNS messages. Normal HTTPS protects the web or application connection to the destination service. They are separate connections with different purposes.
Does DoH use port 443?
DoH uses HTTPS and is commonly carried over the standard HTTPS port 443. The defining element is the configured HTTPS URI and RFC 8484 protocol behaviour, not a promise that every possible deployment is identified solely by a port number.
Does DoH stop DNS spoofing?
The authenticated HTTPS channel protects the DNS exchange from straightforward on-path modification between the client and DoH server. It does not prove that the resolver's underlying DNS data is authentic. DNSSEC addresses signed DNS data integrity and can complement DoH.
Can I use DoH with IPv6?
Yes. DoH carries DNS messages and can return IPv4 A records, IPv6 AAAA records and other DNS data. The HTTPS connection to the DoH resolver can itself operate over IPv4 or IPv6 depending on connectivity and configuration.
Is DNS over HTTPS always more private?
It improves privacy on the network path by encrypting the DNS exchange, but it also concentrates DNS visibility at the chosen resolver. The resolver's policy, jurisdiction, logging practices and relationship to other services remain relevant.
Key takeaway
DNS over HTTPS encrypts DNS queries and responses between a client and a chosen DoH resolver by carrying them over HTTPS. It can stop passive observers on that path from directly reading DNS lookups and can protect the exchange from simple tampering, but it does not make browsing anonymous, replace DNSSEC, encrypt destination traffic or remove the need to trust a resolver. For UK broadband users, the main practical effect is a change in how and where DNS resolution happens—not an increase in broadband speed.
To explore the related technical concepts used in this DNS over HTTPS guide, visit our broadband terminology guide.
