DNS over HTTPS
/ DoH rhymes with go: "doh" /
Classic DNS queries travel in plain text, so anyone on the path — your network, your Internet provider, someone on the same Wi-Fi — can read which names you look up, and could even tamper with the answers. DNS over HTTPS (DoH) hides those queries by wrapping them inside an encrypted HTTPS connection to the resolver. Think of it as putting your lookup in a sealed envelope instead of a postcard: the question and answer still get there, but onlookers can no longer read them.
Concretely, instead of sending a bare DNS query over UDP, your client opens an encrypted connection to a DoH resolver and sends the DNS query as an HTTPS request; the answer comes back inside the same encrypted channel. A close cousin, DNS over TLS (DoT), does the same thing over a TLS connection on its own dedicated port rather than disguised as web traffic. Both achieve the same goal — privacy and tamper-resistance on the link between you and your resolver — and both still rely on the ordinary DNS machinery once the resolver does the actual lookup on your behalf.
Why it matters: encrypted DNS is a privacy move, raising the bar against eavesdropping and on-path tampering of your lookups. But be honest about its boundaries. It encrypts only the hop between you and your resolver, so the resolver operator still sees every name you ask for — you are shifting trust to them, not eliminating it. It does not authenticate the records (that is DNSSEC's job, which is complementary), and it does not hide the destination IP your traffic ultimately goes to. DoH in particular, by blending with normal web traffic, is also debated because it can bypass network-level DNS controls.
On an open cafe Wi-Fi, without encryption a snooper could log that you looked up clinic.example. With DoH, your phone sends that lookup inside an HTTPS connection to its resolver, so the snooper sees only encrypted traffic to the resolver, not the name you asked for.
Encrypts the query on the way to the resolver; the resolver still sees it.
Encrypted DNS protects the link to your resolver, not your whole privacy. The resolver still sees every name, so trust shifts to whoever runs it. And encryption is not authentication: DNSSEC, not DoH/DoT, is what proves an answer was not forged.