doh

DNS over HTTPS, abbreviated as DoH, is a protocol for performing DNS resolution over the HTTPS protocol. Its primary aim is to protect the confidentiality and integrity of DNS queries by transporting them as encrypted web requests rather than in plain UDP traffic.

DoH works by sending DNS queries within HTTP requests to a DoH server. The server resolves the query and returns a DNS response in the HTTP response body. The communication typically runs over HTTP/1.1, HTTP/2, or HTTP/3 and is encrypted with TLS. DNS data can be encoded in the DNS wire format in the request body (content type application/dns-message), and some deployments also support a JSON representation (application/dns-json). DoH resolvers can be operated by individuals, organizations, or public providers.

The protocol was standardized by the Internet Engineering Task Force in RFC 8484, which specifies how DNS messages are transported over HTTPS and how clients and servers should interact. DoH is often considered alongside DNS over TLS (DoT), which also aims to improve privacy but uses TLS without the HTTP layer. Adoption varies by browser, operating system, and network policy, with several major browsers enabling DoH and numerous public resolvers offering DoH endpoints.

Advantages of DoH include enhanced privacy against local network observers and reduced risk of certain network-level tampering. Critics raise concerns about centralization of DNS traffic to a limited set of resolvers, potential bypass of local DNS controls and filtering, and the need for careful configuration to avoid performance or privacy drawbacks. Effective use of DoH is often discussed alongside measures like DNSSEC to ensure authenticity of responses. See also DNS over TLS and DNSSEC.