Priya was troubleshooting oddly slow internet on a public café Wi-Fi network when a more technically inclined friend glanced at her laptop settings and asked, somewhat alarmed, whether she knew her DNS queries were traveling across that network in plain, readable text. She didn’t, and neither did most people around her sipping coffee and checking email on the same unsecured connection. That conversation is exactly the kind of quiet vulnerability DNS over HTTPS was built to close.
What DNS Does and Why It Matters
The Domain Name System, or DNS, translates human-readable website addresses into the numeric IP addresses computers use to locate and connect to servers. Every time you type a website address or click a link, your device sends a DNS query asking to resolve that name into an address, and traditionally, this query traveled across the network completely unencrypted, in plain text readable by anyone positioned to observe that network traffic, from your internet provider to anyone else sharing an unsecured public Wi-Fi connection.
The Privacy Problem With Traditional, Unencrypted DNS
Because traditional DNS queries travel in plain text, they reveal a surprisingly detailed picture of browsing activity to anyone with visibility into that network traffic.
- Internet service providers can see every website domain a device queries, even over an otherwise encrypted website connection
- Anyone on the same unsecured public network, such as café or airport Wi-Fi, can potentially observe DNS queries from nearby devices
- This domain-level browsing history can reveal significant personal information, even without seeing the specific content of pages visited
- DNS queries have historically been a target for surveillance, censorship, and traffic manipulation precisely because they were unencrypted by default
This gap existed for decades largely unnoticed by everyday users, since the website content itself was increasingly encrypted through HTTPS, creating a false sense that browsing activity was fully private when the DNS layer underneath remained a significant, overlooked exception.
How DNS Over HTTPS Solves This
DNS over HTTPS, commonly abbreviated as DoH, encrypts DNS queries by sending them through the same secure HTTPS protocol already used to protect regular website traffic, closing the gap that traditional plain-text DNS left exposed.
- DNS queries are wrapped in the same encryption protecting standard secure website connections
- Network observers, including internet providers and anyone on a shared network, can no longer read the contents of DNS queries in transit
- The encrypted queries are sent to a DoH-compatible DNS resolver rather than using traditional, unencrypted DNS infrastructure
- This approach requires no changes to how websites themselves work, since it specifically addresses the DNS resolution step rather than website content delivery
This targeted fix is part of why DoH adoption has spread relatively quickly compared to some other privacy-focused internet infrastructure changes, since it slots into existing web infrastructure without requiring cooperation or changes from every website DoH-enabled users happen to visit.
How DNS Over HTTPS Differs From DNS Over TLS
Another encrypted DNS approach, DNS over TLS, or DoT, emerged around the same general period and solves a similar underlying problem through a different technical mechanism.
- DoH sends encrypted DNS queries over the standard HTTPS port, blending in with regular encrypted web traffic
- DoT uses a dedicated, separate port specifically for encrypted DNS traffic, making it more distinguishable from regular web traffic
- DoH’s traffic blending makes it harder for a network to selectively block encrypted DNS without also blocking general web traffic
- DoT’s distinct port makes it easier for network administrators to identify and manage, which some enterprise environments prefer
Neither approach is universally superior DoH’s traffic blending offers stronger resistance to selective blocking, which appeals to individual privacy-focused users, while DoT’s clearer separation appeals more to network administrators wanting visibility and control over DNS traffic within a managed environment like a corporate network.
Who Benefits Most From Enabling DNS Over HTTPS
While DoH offers privacy benefits broadly, certain situations make the protection more meaningful in practice.
- Anyone regularly using public Wi-Fi networks, where unencrypted DNS queries are more easily observed by other network users
- People in regions with internet censorship, where DNS-level blocking is a common censorship mechanism DoH can help circumvent
- Privacy-conscious users generally wanting to limit how much browsing information their internet provider can observe and potentially sell
- Anyone concerned about DNS-based tracking used by some advertising and data collection services
For users primarily on trusted, private home networks with a DNS provider they already trust, the practical privacy benefit is somewhat smaller, though it remains a reasonable default privacy improvement with minimal downside for nearly any user in nearly any context.
How to Enable DNS Over HTTPS on Common Platforms
Most major web browsers and operating systems now include built-in support for DNS over HTTPS, making enabling it more accessible than it was in the technology’s earlier days.
- Most modern browsers include a DoH toggle directly within their privacy or network settings menus
- Operating system-level DoH settings apply the encryption to all applications, not just a single browser
- Choosing a specific DoH resolver provider involves some trust consideration, since that provider can still see your DNS queries, just not the network in between
- Some browsers enable DoH by default already, using a preconfigured trusted resolver unless manually changed
Checking whether DoH is already enabled by default, rather than assuming it needs manual activation, is worth doing first, since default behavior varies across different browsers and operating system versions and has shifted toward enabled-by-default in several major platforms over recent years.
Potential Downsides and Considerations Before Enabling
DNS over HTTPS isn’t without some trade-offs worth before assuming it’s an unambiguous improvement in every single scenario.
- Centralizing DNS queries with a single chosen resolver provider shifts trust rather than eliminating it entirely
- Some network-level parental controls and enterprise content filtering rely on visibility into DNS queries that DoH can bypass
- Certain corporate or school networks may have policies against or technical measures against DoH for this exact filtering reason
- Choosing a reputable, privacy-respecting DoH resolver provider matters, since a poorly chosen provider could still log and potentially misuse query data
These trade-offs, rather than assuming DoH is a universally simple privacy upgrade with no downsides, helps users and network administrators make an informed choice appropriate to their specific network environment and privacy priorities.
The Push Toward Encrypted DNS Becoming the Default
The broader trajectory of internet infrastructure has been steadily moving toward encryption becoming the default rather than an opt-in feature, and DNS resolution has followed this same general pattern over recent years.
- Major browser makers have progressively shifted encrypted DNS from an optional, hidden setting to an enabled default for many users
- This shift mirrors the earlier, similar transition of website traffic itself from largely unencrypted to encrypted-by-default
- Industry standards bodies have played a significant coordinating role in establishing DoH and similar protocols as recognized standards
- Continued browser and operating system updates have steadily expanded default encrypted DNS coverage across more users automatically
This gradual, default-driven rollout means many users have already gained DNS encryption protection without ever manually configuring anything, reflecting a broader industry pattern where privacy and security improvements increasingly arrive through default behavior changes rather than requiring active user configuration.
How Network Administrators Are Adapting Their Practices
The rise of encrypted DNS has required network administrators, in enterprise and educational settings, to adapt existing network management and security practices that historically relied on DNS-level visibility.
- Network security tools relying on DNS query inspection have needed updates to handle encrypted DNS traffic appropriately
- Some organizations have shifted toward endpoint-based content filtering rather than relying solely on network-level DNS visibility
- Enterprise DoH policies increasingly specify approved resolver configurations rather than attempting to block encrypted DNS outright
- This adaptation reflects a broader pattern of network security practices evolving alongside increasing default encryption across internet infrastructure
Organizations that have successfully adapted generally describe the transition as a improvement in overall security posture, even though it required updating tools and practices that had remained largely unchanged for many years prior to encrypted DNS becoming widespread.
How Encrypted DNS Interacts With Other Privacy Tools
DNS over HTTPS works alongside, rather than replacing, other privacy and security tools, and how these different layers interact helps build a more coherent overall privacy approach rather than relying on any single tool alone.
- VPNs and DoH can be used together, though some VPN configurations already handle DNS encryption through their own infrastructure
- Ad and tracker blocking tools often operate at a different layer than DoH and continue functioning independently alongside it
- Browser privacy modes address different aspects of privacy, like cookie and history handling, that DoH doesn’t touch at all
- Which specific privacy problem each tool addresses prevents the false confidence of assuming one tool provides comprehensive protection
Building a effective privacy approach generally involves layering several complementary tools, each addressing a different aspect of online privacy, rather than assuming any single tool, including DoH, provides complete protection against every privacy and security concern on its own.
The Broader Trend Toward Encrypting Internet Metadata
DNS encryption is part of a broader industry trend toward reducing the amount of unencrypted metadata visible to network observers, extending well beyond just DNS resolution to other previously unencrypted aspects of internet infrastructure.
- Encrypted Client Hello, a newer protocol addition, addresses metadata exposure that persisted even after DNS and content encryption
- Continued infrastructure investment across the industry reflects a sustained, long-term commitment to closing remaining metadata gaps
- Each successive improvement in this area has required broad coordination across browser makers, server operators, and standards bodies
- This ongoing trend suggests further metadata-focused privacy improvements are likely to continue emerging in the coming years
DoH as one component within this broader, ongoing metadata encryption trend, rather than a standalone, complete solution, provides a more accurate picture of both its value and its place within a continuing, multi-year industry effort toward more comprehensively private internet infrastructure.
How Mobile Networks Handle Encrypted DNS Differently Than Wi-Fi
Encrypted DNS behavior can differ between mobile cellular networks and traditional Wi-Fi connections, an important distinction for anyone regularly switching between the two throughout a typical day.
- Some mobile carriers have their own DNS infrastructure with different default privacy practices than typical home or public Wi-Fi
- Cellular network encrypted DNS support has generally lagged slightly behind broader Wi-Fi and browser-level adoption
- Switching between Wi-Fi and mobile data can sometimes cause inconsistent encrypted DNS behavior depending on device and app-specific settings
- Checking whether encrypted DNS settings persist correctly across both connection types ensures consistent protection throughout the day
This inconsistency is worth checking directly on your own devices, since assuming encrypted DNS protection carries over seamlessly between Wi-Fi and mobile data isn’t always accurate depending on the specific combination of device, operating system, and carrier involved.
How Home Router Manufacturers Are Adding Encrypted DNS Support
Home routers have begun incorporating encrypted DNS support directly at the network level, extending protection to every device on a home network rather than requiring individual configuration on each device separately.
- Router-level DoH configuration protects all connected devices, including smart home devices lacking their own DNS settings
- This approach simplifies protection for households with many connected devices that would otherwise need individual configuration
- Router manufacturer support for this feature varies, with newer router models more likely to include it
- Checking specific router documentation for encrypted DNS support options is worth doing during a router upgrade or replacement
Conclusion: Why Transparency Reports Matter for DNS Resolver Trust
Reputable DoH resolver providers increasingly publish transparency reports detailing their data handling and retention practices, giving privacy-conscious users a more concrete basis for evaluating trust than marketing claims alone. Reviewing these reports, when available, alongside independent security audits some providers commission, offers more assurance than simply choosing a resolver based on name recognition or default configuration, for users who consider DNS privacy a important part of their overall online privacy approach.
Frequently Asked Questions
Does DNS over HTTPS make my internet connection slower?
In most cases, the performance difference is negligible for typical browsing, though it can vary slightly depending on the chosen DoH resolver’s speed and geographic proximity. Some users report a very minor, generally imperceptible latency increase, while others notice no meaningful difference at all.
Does enabling DoH make me completely anonymous online?
No, DoH only encrypts the DNS resolution step of browsing, protecting query contents from network observers between your device and the DNS resolver. It doesn’t hide your IP address, doesn’t encrypt website content beyond what HTTPS already provides, and doesn’t prevent the DNS resolver itself from seeing your queries.
Can my internet provider still see what websites I visit if I use DoH?
Providers can still potentially see the IP addresses your device connects to, even without seeing readable DNS query domain names, though this is less specific information than full plain-text DNS query visibility provided historically before DoH adoption became more widespread.
Should schools and workplaces be concerned about DoH bypassing content filters?
This is a legitimate operational concern for organizations relying on DNS-level content filtering, and many manage it through network policies specifically restricting or disabling DoH on managed devices and networks, rather than relying on DoH remaining disabled by simple default browser behavior.
Is DNS over HTTPS the same thing as using a VPN?
No, these are different technologies addressing different scopes of privacy. A VPN encrypts and routes all of a device’s internet traffic through a remote server, while DoH specifically encrypts only the DNS resolution step, leaving the rest of a connection’s routing and visibility unchanged beyond what DoH itself addresses.
Which DoH resolver provider should I choose?
Several major, well-established providers offer public DoH resolver services with clearly published privacy policies. Reviewing a provider’s specific data retention and privacy practices before choosing, rather than defaulting to whichever option requires the least configuration effort, is a reasonable, worthwhile step for privacy-conscious users.
