DNS over HTTPS Explained: DoH, DoT and DNSSEC Compared

Every time someone visits a website, their device first asks a DNS resolver for the site's address, and traditionally that question travels unencrypted. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt those lookups so people on the same network, and anyone in between, can't read or tamper with them. This guide explains DNS over HTTPS and DNS over TLS in plain English, how browsers and operating systems use them, what they mean for businesses that filter or monitor DNS, and why DNSSEC solves a different problem entirely.

Key takeaways

DNS over HTTPS and DNS over TLS encrypt DNS lookups so people on the same network cannot read or change them.
DoH uses port 443 and looks like normal web traffic, while DoT uses dedicated port 853, which networks can easily spot and block.
On business devices, disable DoH or point it at your filtering resolver, because DoH to an outside resolver bypasses DNS filtering.
DNSSEC is a different protection that proves DNS answers are genuine, and it is the one a domain owner controls.

Why ordinary DNS is a privacy problem

Classic DNS sends queries in plain text, usually over UDP port 53. Anyone who can see the traffic, such as a public Wi-Fi operator, a compromised router or someone on the network path, can:

see every domain a device looks up, which reveals a lot about what someone is doing even when the websites themselves use HTTPS;
change the answers, sending a user to a fake site;
block or redirect lookups, which some networks do deliberately.

HTTPS protects the contents of a web page. Plain DNS leaves the list of sites visited exposed. That's the gap DoH and DoT close.

What DNS over HTTPS (DoH) is

DNS over HTTPS is defined in RFC 8484, published by the IETF in October 2018. It sends DNS queries inside ordinary HTTPS requests to a resolver that supports it, using the application/dns-message format.

Key points:

It runs on port 443, the same as normal web traffic. The RFC notes this lets DoH blend in with other HTTPS traffic, making it harder to interfere with.
Applications can use it directly. A browser can send its lookups over DoH without involving the operating system's DNS settings at all.
The resolver still sees your queries. DoH hides them from the network, not from the resolver you send them to. Choosing that resolver is a trust decision.

What DNS over TLS (DoT) is

DNS over TLS is defined in RFC 7858 (May 2016). It wraps DNS in a TLS connection on a dedicated port, 853.

DoT and DoH offer similar protection against eavesdropping and tampering. The practical differences:

	DNS over HTTPS (DoH)	DNS over TLS (DoT)
Standard	RFC 8484	RFC 7858
Port	443 (shared with web traffic)	853 (dedicated)
Typically used by	Browsers, Windows, apps	Android, routers, some operating systems
Easy for networks to spot	No, looks like HTTPS	Yes, by port
Easy for networks to block	Harder	Easy (block port 853)

There's also DNS over QUIC (DoQ), a newer option standardised by the IETF, but DoH and DoT are what you'll meet in practice.

For privacy they're broadly equivalent. The difference is visibility: DoT is easy for a network administrator to see and manage, while DoH is designed to look like any other HTTPS connection.

How browsers and operating systems use encrypted DNS

Chrome and Edge

Chrome's Secure DNS setting (Settings > Privacy and security > Security > Use secure DNS) works by auto-upgrade by default. According to the Chromium project, Chrome keeps a list of known DoH providers and, if your current DNS resolver is on it, upgrades you to that same provider's DoH service. Your provider doesn't change, so features like filtering and split-horizon DNS keep working. Chromium also says managed deployments are opted out automatically, and administrators can control the feature by policy. Microsoft Edge offers a similar setting.

Firefox

Firefox can use DoH with a chosen provider, and in some regions enables it by default. To respect networks that filter DNS, Mozilla supports a canary domain, use-application-dns.net. If a network's resolver returns no address for that domain, Firefox switches off its default DoH. Mozilla says the canary only affects users who have DoH on by default, not those who turned it on themselves.

Windows

Windows 11 and Windows Server 2022 support DoH in the operating system. Microsoft's documentation explains that if your chosen DNS server is on Windows' list of known DoH servers (which includes Cloudflare, Google and Quad9 addresses), you can pick Encrypted only, Encrypted preferred, unencrypted allowed or Unencrypted only in Settings > Network & Internet. The Configure DNS over HTTPS (DoH) name resolution Group Policy setting lets IT allow, prohibit or require DoH.

Microsoft warns not to choose Require DoH on domain-joined computers, because Active Directory depends on DNS and the Windows Server DNS service doesn't support DoH queries.

Android and Apple devices

Android's Private DNS setting (from Android 9) uses DNS over TLS. In its default automatic mode, Android upgrades to DoT when the network's resolver supports it. In strict mode you enter a provider's hostname and all queries go there; if it can't be reached, Android reports no internet access. iPhones, iPads and Macs support encrypted DNS through configuration profiles or apps, which businesses usually push via mobile device management.

What encrypted DNS means for businesses

DoH is a clear win for people on public Wi-Fi. For businesses that rely on DNS for security, it needs managing.

DNS filtering can be bypassed

Many organisations use DNS filtering to block malware, phishing and unsuitable sites, either through a router feature, a filtering service or, for the public sector, a government service such as the UK NCSC's Protective DNS. If a browser sends lookups over DoH to an outside resolver, your filter never sees them. Chrome's same-provider auto-upgrade and Firefox's canary domain reduce the risk, but a user or a piece of software can still configure its own DoH resolver.

What the NCSC recommends

The UK National Cyber Security Centre's guidance on Protective DNS for the private sector is sound advice wherever you are. It advises organisations to:

Either disable DoH on client operating systems and browsers, or configure it to go via your protective DNS resolver, keeping logging working.
Manage this through Group Policy or mobile device management.
Block outbound DNS on ports 53 and 853 that bypasses your chosen resolver.
Make sure your DNS provider supports any DNS encryption protocols you use.

Blocking port 853 stops rogue DoT. DoH is harder to block because it shares port 443, which is why the guidance focuses on managing settings on the devices themselves.

A practical checklist for small businesses

Decide which resolver you trust. Your filtering service, your ISP or a public resolver.
Point devices at it through the router's DHCP settings or device management.
Set browser policy. Disable DoH or point it at your resolver's DoH address (Chrome's DnsOverHttpsMode and DnsOverHttpsTemplates policies, or Firefox enterprise policies).
Set Windows Group Policy to allow DoH only to your chosen resolver; don't require it on domain-joined PCs.
Block outbound port 53 and 853 at the firewall except from your own resolver, if your router supports it.
Remote staff: use a filtering service with a roaming client or DoH endpoint, so protection follows the laptop.

If you have no DNS filtering at all, the simplest step is to choose a filtering resolver that supports DoH and DoT, then let devices use encrypted DNS to reach it. You get privacy and protection together. Our small business website security guide covers other basics worth doing alongside.

Does DoH affect my website?

Not directly. Your website and its DNS records work the same whatever resolver visitors use. DoH only changes how visitors' devices ask for your records, not what your records contain. Changes still take time to appear because resolvers cache answers; our guide to DNS propagation explains why.

DoH vs DNSSEC: different problems

People often confuse encrypted DNS with DNSSEC. They're complementary, and RFC 7858 says so directly: "DNSSEC and DNS over TLS are independent and fully compatible protocols, each solving different problems."

	DoH / DoT	DNSSEC
Protects	The connection between device and resolver	The DNS data itself
Provides	Privacy (encryption)	Authenticity and integrity (signatures)
Stops	Eavesdropping and tampering on the local network	Forged answers anywhere in the chain
Hides which sites you visit	From the network, yes	No
Who sets it up	Users, IT and resolver operators	Domain owners and DNS hosts

DoH protects the trip; DNSSEC proves the answer is genuine. ICANN describes DNSSEC as using digital signatures so resolvers can verify that data came from the right zone and wasn't modified. It doesn't encrypt anything.

The gap each leaves:

With DoH alone, you trust the resolver completely. If it's compromised, or it receives forged data from upstream, you get a wrong answer delivered privately.
With DNSSEC alone, a validating resolver rejects forged data, but anyone on the network can still see what you look up.

As a domain owner, DNSSEC is the one you control. Turning it on lets validating resolvers detect forged answers for your domain, whatever transport visitors use. Our guide to DNSSEC explains how to enable it safely, including disabling it before moving DNS providers. You can check whether your zone is signed with our DNS lookup tool, which shows your A, AAAA, NS, MX, TXT, SOA and CAA records and reports whether the zone is DNSSEC-signed.

Frequently asked questions

Is DNS over HTTPS worth turning on?

For personal devices, especially on public Wi-Fi, yes. It stops people on the network seeing or changing your DNS lookups. On business devices, configure it to use your company's chosen resolver so security filtering keeps working.

What is the difference between DoH and DoT?

Both encrypt DNS. DoH travels over HTTPS on port 443 and looks like normal web traffic, while DoT uses a dedicated port, 853, which makes it easy for network administrators to identify and manage.

Does DNS over HTTPS hide my browsing from my internet provider?

It hides your DNS lookups from your provider if you use a different resolver, but your provider can still see the IP addresses you connect to, and often the site name during the TLS handshake. It improves privacy rather than making you anonymous.

Can DoH bypass my business's web filtering?

Yes, if a browser or app sends DNS to an outside DoH resolver your filter doesn't see. The NCSC advises disabling DoH on managed devices or pointing it at your protective DNS resolver, and blocking outbound DNS on ports 53 and 853.

Is DNSSEC the same as DNS over HTTPS?

No. DNSSEC adds digital signatures so resolvers can confirm DNS answers are genuine, while DoH encrypts the connection so lookups stay private. They solve different problems and work well together.

DNS over HTTPS Explained: DoH, DoT and DNSSEC Compared

Why ordinary DNS is a privacy problem

What DNS over HTTPS (DoH) is

What DNS over TLS (DoT) is