DNS over HTTPS (DoH) sends DNS queries inside HTTPS connections to a resolver such as 1.1.1.1 or 8.8.8.8. Your network sees only encrypted traffic on port 443 instead of readable lookups on port 53, so it can't log or alter which names you look up.
How it works
The problem with plain DNS
Classic DNS queries travel unencrypted on UDP port 53. Anyone on the path (café Wi-Fi, your ISP) can see every domain you look up, and can redirect lookups, for example to inject ads or block sites.
How DoH works
The client sends the DNS query as an HTTPS request (RFC 8484) to a URL like https://cloudflare-dns.com/dns-query. It's encrypted with TLS and looks like ordinary web traffic.
DoH vs DoT
DNS over TLS (DoT) also encrypts DNS, but on its own port, 853. That makes it easy for networks to identify and block; DoH blends into port 443. Both protect your lookups equally once connected.
Trade-offs
- Your resolver still sees everything, so choose one with a privacy policy you trust.
- It bypasses network-level DNS filtering (parental controls, Pi-hole, company policies) unless that resolver is the one you configure.
- The domain may still be visible in the TLS SNI field when you connect, unless the site uses Encrypted Client Hello.
Examples
You can query a DoH resolver directly:
$ curl -s -H 'accept: application/dns-json' \
'https://cloudflare-dns.com/dns-query?name=apple.com&type=A'
{"Status":0, … "Answer":[{"name":"apple.com","type":1,"TTL":…,"data":"17.253.144.10"}]}
On a Mac
- Browsers: Chrome (Settings › Privacy and security › Use secure DNS) and Firefox (Settings › Privacy & Security › DNS over HTTPS) have it built in.
- System-wide: macOS supports encrypted DNS through configuration profiles or apps such as Cloudflare's 1.1.1.1 app; there's no toggle in System Settings.
- Check what your Mac actually uses with
scutil --dns.
Try it
Not tested: AdGuard DNS and OpenDNS. Their DNS-over-HTTPS servers don’t allow requests from web pages, so a browser can’t time them.
See it in the app
LightAtom reads names from plain DNS answers; apps using their own DoH show up in the connections view as HTTPS connections to resolvers like cloudflare-dns.com.
Frequently asked questions
What is DNS over HTTPS?
A way of sending DNS lookups inside encrypted HTTPS connections, so the network between you and the resolver can't read or change them.
Is DNS over HTTPS better than DNS over TLS?
They offer the same protection. DoH is harder to block because it shares port 443 with normal web traffic; DoT uses port 853.
Does DoH hide my browsing from my ISP?
It hides your DNS lookups, but your ISP can still see the IP addresses you connect to and often the domain in the TLS handshake.
How do I enable DNS over HTTPS on a Mac?
Turn on secure DNS in your browser, or install a configuration profile or resolver app for system-wide encrypted DNS.