What is DNS over HTTPS?

DoH wraps DNS queries in standard HTTPS traffic, so they're encrypted and indistinguishable from other web traffic. It prevents on-path observers (your ISP, public Wi-Fi operators) from seeing or modifying your DNS lookups.

Is DNS over HTTPS faster?

Marginally — sometimes slightly slower due to the HTTPS handshake. The benefit is privacy and integrity, not raw speed. For latency-sensitive use, raw UDP DNS to a fast resolver is usually quickest.

Should I enable DoH in my browser?

For privacy-conscious users on untrusted networks (cafes, hotels, airports) — yes. On a trusted home network with a custom resolver or filtering DNS, it can actually bypass your local controls, so disable selectively.

What's the difference between DoH and DoT?

DoT (DNS over TLS) uses a dedicated port (853) — easy to identify and block. DoH (DNS over HTTPS) uses 443 alongside normal web traffic — harder to block. Both encrypt the query.

DNS over HTTPS (DoH) and DNS over TLS (DoT)

DNS over HTTPS and DNS over TLS: what they protect, and what they don't

For decades DNS traveled in cleartext, observable by every device between you and your resolver. Encrypted DNS — DoH and DoT — finally closes that gap, but the protocol choice has real consequences for performance, privacy, and network management.

What problem encrypted DNS solves

Traditional DNS (UDP/53) is plaintext. Anyone on the network path can:

See every domain you visit, even on HTTPS sites.
Modify responses (DNS spoofing, captive-portal injection).
Block specific lookups silently.

Encrypted DNS encrypts and authenticates the lookup, eliminating those classes of attack between you and the resolver.

DoH vs DoT

DoT (DNS over TLS, port 853) — purpose-built, easy to deploy at the OS or router level, easy for network operators to identify.
DoH (DNS over HTTPS, port 443) — blends in with normal web traffic, harder for networks to block, typically configured per-application (browsers).

Most major resolvers (Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9) support both.

What encrypted DNS doesn't protect

The destination IP is still visible to your ISP and the network.
SNI (Server Name Indication) in TLS often still reveals the hostname unless Encrypted Client Hello is in use.
The resolver still sees every query — you've shifted trust from your ISP to whoever runs the resolver.

Performance reality

Encrypted DNS adds the TLS handshake to the first query of each session. Connection reuse and persistent TLS sessions eliminate most of that overhead. In practice, well-deployed DoH adds 5–20 ms vs plain DNS on first query and near-zero on subsequent queries.

When to enable, when not to

Enable on laptops and phones that roam between networks — coffee shops, hotels, airports.
Consider disabling on home networks where you run filtering DNS (Pi-hole, NextDNS) — browser-level DoH can bypass your filters unless the browser is configured to use the same upstream.
Be aware on corporate networks — DoH can interfere with split-DNS, internal name resolution, and required filtering.