GLOSSARY · DNS OVER HTTPS
DoH
DNS over HTTPS wraps DNS questions and answers inside ordinary encrypted HTTPS traffic to a resolver, as described in RFC 8484. Because it uses the same port and protocol as normal web browsing, observers on the network cannot read the lookups or easily tell them apart from other HTTPS traffic.
Why it matters
DoH protects lookups from the local network and your internet provider, and prevents tampering on the way to the resolver. It does not hide anything from the resolver itself, which sees both the names and your address. Browsers that switch on DoH by themselves can also send lookups to a different resolver than the one your VPN or system uses.
In practice
Chrome, Firefox and Edge include DoH settings, and recent versions of Windows can use it at the system level. Safari follows the system configuration. If you use a VPN with its own DNS, check that browser DoH does not bypass it, then confirm with a DNS leak test. Our fix-a-DNS-leak guide covers each browser.
Related terms
- DoT: DNS over TLS encrypts DNS traffic between your device and a resolver using the same TLS security that protects websites, as set out in RFC 7858.
- DNS: DNS is the internet's naming system.
- DNS resolver: A DNS resolver is the server that does the lookup work on your behalf.
- DNS leak: A DNS leak is when your device sends its DNS lookups to a resolver you did not intend, usually your internet provider's, while you believe a VPN or proxy is handling your traffic.