# DNS over HTTPS

> DNS lookups sent inside encrypted HTTPS, so others on the network cannot read them.

- Level: Advanced
- Topics: Networks, Security
- URL: https://tidbit.legios.com.ar/dns-over-https/
- In Spanish: [DNS over HTTPS](https://tidbit.legios.com.ar/es/dns-over-https/)

Every time you open a site, your device first asks a **DNS** resolver which IP address belongs to that name. For decades those questions traveled in plain text. Anyone on the path, the café Wi-Fi, your internet provider, an attacker on the same network, could read the list of sites you visit and even forge the answers.

**DNS over HTTPS**, or **DoH**, wraps those questions inside HTTPS, the same encryption that protects web pages. To an observer, a DoH lookup looks like any other HTTPS traffic to the resolver. The IETF standardized it in 2018 as RFC 8484, and major browsers and operating systems can use it with public resolvers like Cloudflare's `1.1.1.1`, Google's `8.8.8.8` or Quad9. A close cousin, **DNS over TLS** (DoT), also encrypts DNS but on its own dedicated port, which makes it easier for a network to spot and block.

It is not a privacy cure-all. The resolver you send your questions to still sees every one of them, so you are moving your trust, not removing it. Your provider still sees which IP addresses you connect to, and the site's name can still leak in other parts of the connection. It also has a side effect that companies and schools dislike: filters that work by blocking DNS on the local network stop working when devices skip them, which is why many managed networks turn it off.

## An analogy

Asking a librarian where a book is by handing over a sealed note instead of shouting the question across the room. The people around you cannot hear it, but the librarian still reads every note.

## Keep in mind

- DoH encrypts DNS lookups by sending them over HTTPS.
- It was standardized in 2018 as RFC 8484 and is built into major browsers.
- The resolver still sees your queries; you choose whom to trust.
- It bypasses DNS filters on the local network, which some networks block.

## Go deeper

- [RFC 8484: DNS Queries over HTTPS](https://datatracker.ietf.org/doc/html/rfc8484)
- [DNS over HTTPS in Firefox (Mozilla Support)](https://support.mozilla.org/en-US/kb/firefox-dns-over-https)
- [DNS over HTTPS (Cloudflare docs)](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/)

## Related terms

- [DNS](https://tidbit.legios.com.ar/dns/): The internet's phone book: it turns names like wikipedia.org into IP addresses.
- [IP address](https://tidbit.legios.com.ar/ip-address/): The number that identifies a device on a network, like a postal address.
- [Wi-Fi](https://tidbit.legios.com.ar/wi-fi/): Networking over radio waves: the internet without the cable, within a few rooms.
- [ISP](https://tidbit.legios.com.ar/isp/): The company you pay to connect your home or phone to the internet.
- [HTTPS](https://tidbit.legios.com.ar/https/): The padlock in your browser: web traffic nobody in between can read.
- [Encryption](https://tidbit.legios.com.ar/encryption/): Scrambling data so that only someone with the key can read it.
- [Website](https://tidbit.legios.com.ar/website/): A set of web pages under one address, stored on a server and opened in a browser.
- [Web browser](https://tidbit.legios.com.ar/web-browser/): The app that fetches web pages from the internet and draws them on your screen.