• Glossary
  • What is DoH (DNS over HTTPS)?

DNS glossary

What is DoH (DNS over HTTPS)?

DNS over HTTPS (DoH) is a network protocol that encrypts DNS queries and responses by carrying them inside HTTPS connections. It is defined in RFC 8484 and sends DNS messages to a DoH server over port 443, so resolver traffic is protected from on-path observation and tampering.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

DNS over HTTPS (DoH) is a network protocol defined in RFC 8484 that encrypts DNS queries and responses by wrapping them inside HTTPS connections on port 443, protecting resolver traffic from observation and tampering. For enterprises, the main operational challenge is that applications or browsers using their own DoH servers bypass internal resolvers, eliminating DNS filtering, split-horizon records, query logging, and threat detection capabilities. Managing DoH effectively requires organizations to approve internal DoH-capable resolvers, enforce client policies, and monitor or block unauthorized DoH server connections to maintain DNS visibility and security posture.

  • DoH encapsulates DNS messages in HTTP/2 requests using the application/dns-message media type and shares port 443 with ordinary web traffic, making it indistinguishable from standard HTTPS and difficult to control by port-based filtering.
  • Security teams lose critical telemetry and query logging when clients bypass internal resolvers, and blocklist-based controls, sinkholes, and response policy zones no longer apply to DoH traffic.
  • DoH depends on valid TLS certificate chains and correct system clocks; certificate validation failures or TLS-inspecting proxies can cause clients to fall back silently to unencrypted DNS, obscuring policy testing and incident investigation.

DoH at a glance

AttributeValue
Full nameDNS over HTTPS
CategoryEncrypted DNS transport protocol
Defined inRFC 8484
Protocol and portHTTPS over TCP, port 443 by default
OSI layerApplication layer (layer 7)
Primary useEncrypting DNS traffic between a client and a recursive resolver
Related termsDNS over TLS, DNS, Recursive resolver, TLS, DNS filtering

How DoH works

A DoH client wraps an ordinary DNS message in an HTTPS request and sends it to a DoH server. The server returns the DNS answer in the HTTPS response.

  1. Locate the DoH server: The client is configured with a URI template for the DoH server. It resolves the server hostname if needed and opens a TCP connection, to port 443 unless the URI names another port.
  2. Establish TLS: The client and server negotiate a TLS session, and the client validates the server certificate. This authenticates the server and encrypts everything that follows.
  3. Send the query: The client encodes the DNS query in standard wire format and sends it in an HTTP request using the GET or POST method. The message uses the application/dns-message media type.
  4. Return the answer: The server resolves the name and returns the DNS response in the body of the HTTP response. The client uses it like any other DNS answer. RFC 8484 names HTTP/2 as the minimum recommended HTTP version, which lets many queries share one connection.

Because the session is encrypted, devices on the path see only a TLS connection to the DoH server and cannot read or alter the query names. DoH protects only the hop between client and resolver. It does not encrypt traffic from the resolver to authoritative servers, and the resolver operator still sees every query.

Why DoH matters in enterprise networks

Traditional DNS over UDP and TCP port 53 is unencrypted, so anyone on the network path can read or modify queries. RFC 8484 standardized DoH to close that gap by carrying DNS inside HTTPS. A separate standard, DNS over TLS in RFC 7858, encrypts DNS on its own dedicated port, 853. That distinction drives the DoH versus DNS over TLS comparison: both encrypt the same traffic, but DoH shares port 443 with ordinary web traffic, while DNS over TLS can be identified, and therefore managed or blocked, by port.

For enterprises, the main operational effect is loss of visibility. An application or browser that uses its own DoH server bypasses the internal resolver, so DNS filtering, split-horizon answers for private zones, query logging and threat detection tied to that resolver no longer apply to that traffic. Internal names may fail to resolve, and security teams lose a rich source of telemetry.

Managing DoH well means deciding which resolvers clients may use. Common approaches are to run an approved internal DoH-capable resolver, set client and browser policy to use it, and block or monitor connections to unsanctioned DoH servers. Leaving it unmanaged splits DNS across resolvers, which makes troubleshooting, auditing and incident response harder.

DoH vs DNS over TLS (DoT)

DoH carries DNS messages inside HTTPS on port 443, while DoT carries them directly inside a TLS session on a dedicated port, so DoT is easier for a network to identify and control. What is DNS over TLS?

AttributeDoHDNS over TLS (DoT)
StandardRFC 8484RFC 7858
TransportHTTP over TLSTLS directly over TCP
Default port443853
Visibility to network operatorsBlends with other HTTPS traffic, so port-based control is not possibleIdentifiable by its dedicated port, so it can be allowed, monitored or blocked
Message overheadAdds HTTP framing to each DNS messageAdds no HTTP framing
Typical clientOften built into browsers and applicationsOften configured at the operating system or resolver level

Common DoH issues

A browser or application with its own DoH resolver setting sends queries straight to a public server and skips the internal resolver. Internal zones then fail with NXDOMAIN or timeouts, and split-horizon records, filtering policy and query logging stop applying to that client.

Security tools that inspect or log traffic on port 53 see nothing from DoH clients. Blocklists, sinkholes and response policy zones do not take effect, and investigators find gaps in query history for those hosts.

DoH depends on TLS, so a wrong system clock, an untrusted certificate chain or a TLS-inspecting proxy can make the client fail to connect to the DoH server. Depending on configuration, the client either falls back to unencrypted DNS or resolution stops.

Because DoH shares port 443 with web traffic, blocking the port is not possible without breaking HTTPS. Teams that block known DoH server addresses find that new or self-hosted servers still get through, so the list needs ongoing maintenance.

Some clients retry over unencrypted DNS when the DoH server is unreachable. Engineers testing a policy may see queries on port 53 and assume DoH is off, when the client is simply using its fallback path.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

DoH FAQ

Related terms

Article

DNS over TLS (DoT)

DNS over TLS (DoT) encrypts DNS queries and responses using Transport Layer Security, protecting communications between DNS clients and resolvers.

Learn more
Article

DNS – Domain Name System

The Domain Name System (DNS) is a hierarchical naming system that resolves domain names to IP addresses, enabling communication across network devices.

Learn more
Article

Transport layer security (TLS)

TLS (transport layer security) is a cryptographic protocol that provides communications security over a computer network.

Learn more
Article

DNSSEC (Domain Name Service Security Extension)

DNSSEC (Domain Name Service Security Extension) is a mechanism that uses cryptography to authenticate DNS data and verify the integrity of DNS queries and responses.

Learn more
Article

DNS Filtering

DNS filtering controls access to websites and online resources by allowing or blocking DNS queries based on predefined security policies and threat intelligence.

Learn more
Article

Split-Horizon DNS

Split-horizon DNS provides different DNS responses to internal and external users based on their location or network, helping organizations manage access to resources.

Learn more
Article

DNS stub resolver

A DNS stub resolver is the component on a client device that initiates and facilitates DNS queries to recursive resolvers.

Learn more
Article

Recursive DNS server

A recursive DNS server is the first server contacted by a requesting host; it retrieves the proper IP address of the intended domain name and returns it to the requester.

Learn more
Browse the full glossary