What Is DNS Over HTTPS (DoH)? A Guide to Secure Browsing

In today’s digital world, protecting your online privacy is more important than ever. DNS over HTTPS (DoH) is a powerful tool that enhances the security of your internet browsing by encrypting DNS queries. This article dives into what DoH is, how it works, its benefits and drawbacks, and how to enable it across various platforms.

Understanding DNS Over HTTPS

DNS over HTTPS (DoH) is a protocol that secures your DNS (Domain Name System) queries by wrapping them in encrypted HTTPS traffic. Unlike traditional DNS, which sends queries in plain text, DoH uses the same encryption as secure websites, shielding your browsing activity from prying eyes like ISPs, network administrators, or cybercriminals.

Traditional DNS queries are unencrypted, making them vulnerable to interception, manipulation, or surveillance. This can lead to risks such as DNS spoofing or man-in-the-middle (MITM) attacks. DoH addresses these vulnerabilities by ensuring your DNS requests are encrypted, offering a higher level of privacy and security.

Important Note: Manually configuring DoH alongside a VPN may cause DNS queries to bypass the VPN tunnel, potentially exposing them to unauthorized parties. This issue typically arises only with manual configurations, not default browser settings. Always exercise caution and configure DoH at your discretion.

How DNS Over HTTPS Works

DoH follows the same basic process as traditional DNS but adds a layer of encryption. Here’s how it operates:

• Initiating the Query: When you enter a website’s URL, your browser generates a DNS query to retrieve the site’s IP address.
• Encrypting the Query: The query is encapsulated in an HTTPS request, encrypted using TLS (Transport Layer Security), and sent over port 443, blending seamlessly with regular web traffic.
• Sending to a Resolver: The encrypted query is transmitted to a DoH-compatible resolver, such as those provided by Cloudflare or Google.
• Receiving the Response: The resolver decrypts the query, retrieves the IP address, and sends an encrypted response back to your browser.
• Connecting to the Site: Your browser decrypts the response, obtains the IP address, and loads the website securely.

Pros and Cons of Using DNS Over HTTPS

Enabling DoH can significantly boost your online privacy, but it’s not without trade-offs. Below is a breakdown of its advantages and potential drawbacks:

DoH is an excellent choice for users prioritizing privacy, but those relying on DNS-based filtering or monitoring may need to weigh the trade-offs carefully.

Enabling DNS Over HTTPS in Browsers

Most modern browsers support DoH natively, making it easy to enable with a few clicks. Here’s how to set it up in popular browsers:

Google Chrome

• Navigate to Settings > Privacy and Security > Security.
• Find Use Secure DNS and toggle it on.
• Select your current provider or enter a custom DoH resolver.

Mozilla Firefox

• Go to Settings > Privacy & Security.
• Locate DNS over HTTPS and enable it.
• Choose your preferred protection level: Default, Increased, or Max.

Microsoft Edge

• Access Settings > Privacy, Search, and Services.
• Under Security, enable Use Secure DNS.
• Choose your provider or specify a custom resolver.

Enabling DNS Over HTTPS on Operating Systems

For system-wide DoH protection, configure it at the OS level. Here’s how to do it on various platforms:

Windows 11

• Go to Settings > Network & Internet > Wi-Fi or Ethernet.
• Select your network, then click Edit under DNS Server Assignment.
• Enter a DoH-compatible DNS server (e.g., Cloudflare: 1.1.1.1, 1.0.0.1).
• Set Preferred DNS Encryption to Encrypted Only (DNS over HTTPS).

macOS 14 (Sonoma) and Later

• Open System Settings > Network and select your network.
• Under DNS, add a DoH-supported provider using the “+” icon.

Android 9 (Pie) and Later

• Go to Settings > Network & Internet > Private DNS.
• Select Private DNS Provider Hostname and enter a DoH resolver (e.g., dns.google).

iOS/iPadOS 17 and Later

• Install an Encrypted DNS profile from a provider or via an MDM system.

Verifying Your DNS Over HTTPS Setup

To ensure DoH is active and working correctly, use these methods:

• Online Tools: Visit websites like 1.1.1.1/help to confirm DoH is enabled and identify your DNS resolver.
• Command Line: On Windows, run nslookup -type=txt doh.opendns.com in PowerShell to check your resolver and DoH status.
• Network Settings: Review your device’s DNS configuration to verify the active DNS server.

Disabling DNS Over HTTPS

In some cases, you may need to disable DoH, such as when using local DNS filters or troubleshooting network issues. Here’s how:

• Windows 11: Set DNS encryption to Unencrypted in network settings.
• Chrome/Edge: Disable Secure DNS in browser settings.
• Firefox: Turn off DoH in Privacy & Security or set network.trr.mode = 5 in about:config.

DNS Over HTTPS vs. Other Protocols

DoH is one of several methods to secure DNS traffic. Here’s how it compares to others:

Each protocol has its strengths, with DoH excelling in compatibility and privacy, while DoT and DoQ offer alternative approaches for specific use cases.

Conclusion

DNS over HTTPS is a game-changer for online privacy, encrypting your DNS queries to protect your browsing from surveillance and tampering. By enabling DoH in your browser or operating system, you can take a significant step toward a more secure digital experience. However, consider the potential trade-offs, such as bypassing local filters or centralizing data with a single resolver. With the right configuration, DoH empowers you to browse with confidence.