What is DNS over HTTPS (DoH)?

DNS over HTTPS (DoH) sends DNS queries inside encrypted HTTPS to a configured resolver, typically on port 443. Instead of cleartext UDP to port 53, the browser or OS wraps DNS messages in TLS. Onlookers on the local network see a TLS connection to the resolver, not individual domain names in the DNS payload.

How DoH differs from classic DNS

Traditional DNS is readable to the resolver path and easy to filter or spoof on untrusted Wi-Fi. DoH moves resolution into an HTTP API (often GET or POST) so the query and response share the same confidentiality and integrity tools as web traffic. The resolver still learns which names you looked up, so trust in the DoH provider matters.

Deployment modes include browser-only DoH, which covers that browser’s tabs but not every app, and system-wide DoH on newer operating systems. DoT (DNS over TLS on port 853) is a sibling design; DoH blends in with other HTTPS flows, which helps in restrictive networks but can complicate enterprise inspection policies.

DoH does not hide your IP from the sites you visit. It mainly shields DNS contents from local snooping and some ISP logging. Combine with a VPN when you need stronger tunneling of all traffic.

Implications for ads, analytics, and abuse

Marketing teams sometimes worry that encrypted DNS blocks legitimate filtering. Schools and offices that relied on DNS blocklists may need explicit policies or resolver contracts that still apply filtering while using TLS. That is an IT governance topic more than a PPC toggle.

From a ad fraud perspective, DoH does not make a bot human. Click quality still depends on IP reputation, device integrity, rate patterns, and conversion data. Attackers already control resolvers or bypass DNS. Honest users adopt DoH for privacy on coffee-shop Wi-Fi. Products should score risk without punishing every encrypted DNS user.

Related reading: understand resolver visibility alongside ISP roles, proxy chains, and how fraud is detected. For campaign hygiene, clean traffic in Google Ads stays relevant regardless of DNS transport.