Every time you visit a website, your device usually asks DNS for its IP address first. Traditional DNS sends that question without encryption, so the network carrying it can often see or tamper with the request. DNS over HTTPS (DoH) fixes that transport problem by placing DNS inside an HTTPS connection.

It is a useful privacy upgrade, but it is not an invisibility cloak. Understanding what it does — and what it does not — helps you choose a sensible setup.

What changes with DoH

Without DoH, a typical lookup travels over UDP or TCP port 53. With DoH, the client sends the DNS query to a compatible resolver over HTTPS, normally on port 443.

That protects the query from casual inspection and modification on the path between you and the resolver. Public Wi-Fi operators and intermediate routers no longer get the same easy view of those DNS requests.

Your chosen resolver still receives the queries. Your device still connects to the destination IP afterward. DoH shifts trust; it does not eliminate it.

DoH, DoT, and ordinary DNS

DNS over TLS (DoT) solves a similar transport problem using a dedicated TLS service, usually on port 853. DoH blends into HTTPS traffic and can be easier to deploy through restrictive networks. Neither is automatically “more anonymous.”

The useful comparison is:

  • Plain DNS: simple and widely supported, but unencrypted between client and resolver.
  • DoT: encrypted DNS with a distinct port and identity.
  • DoH: encrypted DNS carried through HTTPS, often configured in browsers and operating systems.

A local resolver such as Unbound or Pi-hole can still provide filtering and caching while forwarding upstream over an encrypted protocol. That gives you central control without sending every device's queries in the clear to an outside resolver.

Turn it on without breaking your network

The easiest place to test is a browser that supports encrypted DNS. Choose a resolver you trust, enable its secure-DNS option, and visit that provider's test page to confirm the browser is using it.

Then consider the rest of the system. Browser-only DoH does not automatically protect lookups made by other applications. Operating-system support provides broader coverage, but availability and behavior differ across platforms.

On a home network, decide who should control DNS:

  • If you rely on Pi-hole or AdGuard Home for filtering, do not let every device silently bypass it with different DoH settings.
  • If you manage children's devices or a workplace network, document the approved resolvers rather than discovering unexpected policies later.
  • If an application has its own DNS setting, remember that changing the router alone may not change that application's behavior.

For a refresher on the records behind the lookup, see our DNS records guide.

The privacy claims to ignore

DoH does not hide all website metadata. The destination IP remains visible, and the TLS handshake can reveal the hostname unless additional protections such as Encrypted Client Hello apply. A resolver can also observe query patterns even when the transport is encrypted.

DoH is not a VPN. It does not route the rest of your traffic through another network, change your public IP, or make an unsafe website safe.

It also cannot guarantee integrity all the way to an authoritative server. It protects the client-to-resolver leg; DNSSEC addresses a different problem by allowing DNS responses to be validated cryptographically.

Should you use it?

For a laptop on untrusted Wi-Fi, encrypted DNS is a sensible default. Choose a resolver with a clear privacy policy and good reliability, then verify that it works with your filtering and local hostnames.

For a homelab, central DNS plus encrypted upstream forwarding is often cleaner than a different browser setting on every device. For a business, make it a deliberate policy rather than an accidental mix of browser defaults.

The win is straightforward: fewer people on the network path can watch or alter your lookups. Just do not mistake one encrypted hop for complete privacy.