What Is DNS over HTTPS (DoH)?

Abisola | Feb 9, 2026

DNS over HTTPS (DoH) sends DNS queries inside encrypted HTTPS to a configured resolver, typically on port 443. Onlookers on the local network see a TLS connection to the resolver, not individual domain names in the DNS payload. Privacy improves, but network filters that relied on cleartext DNS need a new design.

Traditional DNS is readable along the resolver path and easy to filter or spoof on untrusted Wi-Fi. DoH moves resolution into an HTTP API so the query and response share the same confidentiality tools as web traffic. The resolver still learns which names you looked up, so trust in the DoH provider matters. Related: DNS leak.

How DoH differs from classic DNS

Deployment modes include browser-only DoH, which covers that browser’s tabs but not every app, and system-wide DoH on newer operating systems. DoT (DNS over TLS on port 853) is a sibling design; DoH blends in with other HTTPS flows, which helps in restrictive networks but can complicate enterprise inspection policies.

DoH does not hide your IP from the sites you visit. It mainly shields DNS contents from local snooping and some ISP logging. Combine with a VPN when you need stronger tunneling of all traffic.

Implications for ads, analytics, and abuse

Marketing teams sometimes worry that encrypted DNS blocks legitimate filtering. Schools and offices that relied on DNS blocklists may need explicit policies or resolver contracts that still apply filtering while using TLS. That is an IT governance topic more than a PPC toggle.

From an ad fraud perspective, DoH does not make a bot human. Click quality still depends on IP reputation, device integrity, rate patterns, and conversion data. Attackers already control resolvers or bypass DNS. Honest users adopt DoH for privacy on coffee-shop Wi-Fi. Soft context: site bot detection should score risk without punishing every encrypted DNS user. Related: ISP roles and proxy chains.

Frequently Asked Questions

  • Does DNS over HTTPS hide my IP address?

    No. DoH encrypts the DNS lookup so local networks and some ISPs cannot read which hostnames you resolve. The sites you visit still see your public IP unless you also use a VPN or proxy. Treat DoH as privacy for DNS contents, not as a full anonymization tool for browsing.

  • Should you use DNS over HTTPS?

    For many people on untrusted Wi-Fi, yes: DoH reduces cleartext DNS snooping. Choose a resolver you trust, because that provider still sees your lookups. Enterprises may prefer managed resolvers that keep filtering and logging policies. Test that apps you care about still resolve correctly after you enable DoH.

  • Why is DNS over HTTPS controversial?

    DoH improves user privacy but can bypass local DNS filters that schools, offices, and some ISPs used for safety or policy. It also concentrates lookups at a few large resolvers. Supporters value encrypted DNS; critics want network operators to keep visibility. Both sides are debating control of the resolution path.

Abisola

Abisola

Abisola handles content and support at ClickPatrol. She helps customers get more value from cleaner traffic data and writes practical resources about ad fraud, fake traffic, and smarter PPC decisions.