DNS over HTTPS (DoH): What It Is and How to Test It

What DoH Actually Does

DoH sends DNS queries and responses inside HTTPS, the same protocol used for regular web browsing, instead of the traditional plaintext UDP or TCP on port 53. To an observer on the network, a DoH query is indistinguishable from any other HTTPS request to that server.

Why It Matters

A plaintext DNS query reveals every domain you look up to anyone on the path — your ISP, a public Wi-Fi operator, or an on-path attacker — even if the site itself is loaded over HTTPS afterward. DoH encrypts the query itself, closing that specific gap.

DoH vs. DNS over TLS (DoT)

DoT encrypts DNS the same way, but over its own dedicated port, 853. That makes it just as easy to block as plain DNS — a network operator only has to block one port. DoH deliberately shares port 443 with regular HTTPS traffic, so blocking it without also blocking most of the web is far harder.

The Trade-Off

That same property is what makes DoH genuinely controversial: it can bypass DNS-based filtering set up at the network level — by an employer, a school, or parental-control software — since the traffic no longer looks like DNS to anything monitoring port 53. This is a real, actively debated trade-off between individual privacy and network-level policy enforcement, not a settled technical footnote.

Checking Whether DoH Is Active

Testing a resolver's DoH endpoint directly confirms whether it responds correctly over HTTPS, independent of whether your browser or OS is actually configured to use it for everyday lookups.