Key Takeaways
- Traditional DNS queries travel unencrypted, making them readable to your ISP and anyone monitoring the network.
- DNS over HTTPS encrypts DNS queries inside standard web traffic, hiding them from network-level observers.
- DoH shifts trust from your ISP to whichever DNS resolver you configure — that choice matters.
- Most modern browsers support DoH and can be configured independently of your operating system.
- DoH does not make you anonymous online; it only protects one specific layer of your network activity.
Option A
Traditional DNS
The long-standing, universal default — but open to inspection.
Best for: Networks where compatibility and speed are prioritized over query-level privacy.
Option B
DNS over HTTPS (DoH)
The privacy-forward evolution that encrypts your DNS queries.
Best for: Users who want to prevent ISPs or network observers from reading their DNS lookup history.
If you use public Wi-Fi regularly and want basic query privacy
DNS over HTTPS (DoH)
On open networks, traditional DNS queries are trivially readable. DoH encrypts them, removing one straightforward surveillance vector.
If you manage a corporate or school network with content filtering
Traditional DNS
Network-level DNS filtering depends on inspecting queries in transit. DoH bypasses those controls, which can create compliance and security issues for administrators.
If you want to reduce what your ISP can infer about your browsing habits
DNS over HTTPS (DoH)
ISPs can log traditional DNS queries to build a picture of your online activity. DoH removes that visibility at the query level.
If compatibility with older routers and embedded devices matters most
Traditional DNS
Standard DNS operates on a universally supported protocol. DoH requires software or OS-level support that not all devices provide.
What DNS Actually Does — and Why It's a Privacy Concern
Every time you type a web address, your device runs a behind-the-scenes lookup to translate that human-readable name — like example.com — into a numeric IP address computers use to route traffic. This lookup is handled by the Domain Name System (DNS), often described as the internet's phone book.
The problem with traditional DNS is that these queries are sent in plain text over port 53, the standard DNS channel. That means anyone positioned between your device and the DNS resolver — your internet service provider (ISP), a network administrator, or someone monitoring a shared Wi-Fi connection — can read exactly which domains you're looking up, even when the websites themselves use HTTPS encryption. As our related article on what the HTTPS padlock actually means explains, encrypted site connections don't protect the lookup that precedes them.
This exposure predates widespread privacy awareness in internet infrastructure design, and it remains the default behavior for most devices and networks today.
How DNS over HTTPS Changes the Picture
DNS over HTTPS (DoH) was standardized by the Internet Engineering Task Force in RFC 8484 (published 2018) and works by wrapping DNS queries inside ordinary HTTPS traffic on port 443 — the same channel used for secure web browsing. To a network observer, DoH traffic is indistinguishable from regular encrypted web requests.
The practical result: your ISP, router, or a shared-network eavesdropper can no longer read which domains your device is querying. The queries are encrypted end-to-end between your device and the DoH resolver you've selected.
| Criterion | Traditional DNS | DNS over HTTPS (DoH) |
|---|---|---|
| Encryption | None — plain text | Encrypted via HTTPS |
| Visible to ISP | Yes, all queries readable | No, queries are hidden |
| Port used | Port 53 | Port 443 (standard HTTPS) |
| Network compatibility | Universal — works everywhere | Requires software support |
| Network filtering bypass | Respects DNS-based filters | May bypass DNS-level filters |
| Trust model | ISP or local resolver | Chosen DoH resolver |
| Browser support | Default behavior | Opt-in in most browsers |
It's worth noting what DoH does not do. It doesn't hide your IP address, encrypt the actual content of web pages, or prevent the destination website from knowing you visited. Think of it as closing one window that was always left open — an important step, but not a complete privacy solution. For a broader picture of what browser-level tools actually protect, see our piece on what private browsing actually hides.
The Trust Trade-Off: From ISP to Resolver
Enabling DoH doesn't eliminate the need to trust someone with your DNS queries — it shifts who that someone is. With traditional DNS, your ISP's resolver typically handles lookups and can log them. With DoH, you're directing queries to a third-party resolver (such as one operated by a major tech company, a privacy-focused DNS service, or your own infrastructure).
That resolver still sees all your DNS queries. The key questions to ask: Does the resolver have a published privacy policy? Does it log query data, and for how long? Is it subject to data requests under applicable law?
Choosing a DoH Resolver: What to Look For
When selecting a DoH resolver, prioritize providers with clearly stated no-logging policies and a track record of independent audits. Also consider jurisdiction: a resolver based in a country with strong data-protection laws offers different legal protections than one subject to broad government data-access authority. Reading the privacy policy before committing is a reasonable, worthwhile step.
For consumers who want to go further, a VPN also encrypts DNS queries alongside all other traffic — but introduces its own trust considerations. Our comparison of consumer VPN trade-offs on home networks covers that terrain in detail.
How to Enable DoH on Common Browsers and Devices
Most major browsers now support DoH independently of your operating system settings, meaning you can enable it without changing anything at the router level.
- Chrome / Edge: Navigate to Settings > Privacy and security > Security and toggle Use secure DNS. You can select a provider or enter a custom resolver address.
- Firefox: Go to Settings > Privacy & Security, scroll to DNS over HTTPS, and choose your protection level and provider.
- Windows 11: Supports system-wide DoH under Settings > Network & Internet > > DNS server assignment.
- Android 9+: Offers a related protocol called Private DNS (which uses DNS over TLS rather than HTTPS, but achieves similar encryption goals) under Settings > Network & Internet.
Enabling DoH at the browser level only protects queries from that browser. Other apps on your device continue using the system DNS unless you configure DoH at the OS or router level.
RFC 8484
IETF standard defining DNS over HTTPS
Published by the Internet Engineering Task Force in October 2018, establishing DoH as an official internet standard.
Port 53
Traditional DNS port — unencrypted by default
DNS has used port 53 since the protocol's original specification in 1983, predating modern encryption expectations.