Protect your browsing privacy with DNS over HTTPS (DoH).
Traditional DNS transmits queries in clear text on UDP port 53. This means your ISP, network administrator, or any attacker on the path can see which sites you're visiting, even if those sites use HTTPS. DNS over HTTPS (DoH) solves this by encapsulating DNS queries in encrypted HTTPS connections, making them indistinguishable from normal web traffic.
Since 2018, DoH has rapidly deployed: Firefox, Chrome, Edge and Safari support it natively. Windows 11 and latest iOS/Android versions integrate it at the system level. Major public resolvers (Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9) all offer DoH endpoints.
DoH is not without controversy: it centralizes DNS toward a few big players, can complicate parental controls and enterprise security, and some see it as a threat to network sovereignty. Understanding its advantages and limitations will help you decide if it suits your use case.
DNS over HTTPS encapsulates the DNS protocol in HTTPS:
DoH brings several significant benefits:
Here's how to enable DoH on your platform:
Here's how to test and use DoH manually:
# DoH query with curl (GET method)
$ curl -s -H "accept: application/dns-json" \
"https://cloudflare-dns.com/dns-query?name=example.com&type=A"
{
"Status": 0,
"Answer": [
{"name": "example.com", "type": 1, "TTL": 3600, "data": "93.184.216.34"}
]
}
# DoH query with curl (POST method, wire format)
$ echo -n "q80BAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE=" | base64 -d | \
curl -s -H "content-type: application/dns-message" \
--data-binary @- https://cloudflare-dns.com/dns-query | xxd
# Popular DoH endpoints
# Cloudflare: https://cloudflare-dns.com/dns-query
# Google: https://dns.google/dns-query
# Quad9: https://dns.quad9.net/dns-query
# NextDNS: https://dns.nextdns.io/dns-query
# Test if DoH is working via Firefox
about:networking#dns
# Shows "TRR" (Trusted Recursive Resolver) if DoH active
# Verify DoH is working
# https://1.1.1.1/help (Cloudflare)
# https://dnsleaktest.com/DoH queries are simple HTTPS requests with a specific content-type. JSON format (dns-json) is more readable for debugging, wire format (dns-message) is more compact and used by real clients.
Use DoH effectively while understanding its limits:
DoH uses HTTPS on port 443, indistinguishable from web traffic. DoT (DNS over TLS) uses dedicated port 853. DoH is harder to block but easier to configure in browsers.
With difficulty, since DoH looks like normal web traffic. They'd need to block specific IPs or SNI. Some DoH resolvers offer residential IPs to bypass these blocks.
Initial TLS establishment adds latency, but HTTP/2 and connection reuse compensate. In practice, DoH is often as fast or faster than classic DNS, especially with Anycast resolvers.
DoH protects against DNS-based tracking (ISP, local network). But sites can still track you via cookies, fingerprinting, etc. It's only one layer of protection.
Yes, software like cloudflared (Cloudflare's DoH proxy), dnsdist, or unbound let you create your own DoH endpoint pointing to your resolver of choice.
MoniTao monitors your DNS records using standard DNS queries to authoritative servers. Monitoring doesn't go through DoH since we query your NS directly.
DNS over HTTPS is a major advancement for Internet privacy. In a few clicks, you can prevent your ISP and networks you traverse from seeing which sites you're visiting.
Enable DoH on your devices, choose a trusted resolver, and combine with DNSSEC for complete protection. Monitoring your DNS records remains important - MoniTao watches over your DNS infrastructure independently of DoH.
Start free, no credit card required.