The short answer
DNS over HTTPS (DoH) is a protocol for sending DNS queries and responses over HTTPS. Instead of placing a conventional DNS request directly on the network, a device or application exchanges the DNS message with a resolver through an encrypted HTTPS connection.
That protects the DNS traffic between your device and the chosen resolver from people who can observe that local network path. It does not hide your activity from the resolver, turn DNS into a VPN, or make website traffic anonymous.
Why DNS encryption exists
DNS helps applications find the address for a name, as explained in What Is DNS?. Traditional DNS traffic is commonly unencrypted. Someone operating a local Wi-Fi network, an ISP network, or another network between a device and its resolver may be able to observe those lookup names or interfere with unsecured traffic.
DoH uses HTTPS, which normally uses TLS for confidentiality and integrity. A passive observer should not be able to read the DNS messages in transit, and the client can authenticate the resolver's HTTPS endpoint through the normal certificate process.
How DoH works
The DoH standard maps a DNS query and its response to an HTTP exchange. A client sends the DNS message to a resolver's HTTPS endpoint and receives a DNS response in return. The protocol can use ordinary HTTPS features such as HTTP/2 or HTTP/3 connections and connection reuse.
This does not mean every HTTPS request is DNS. DoH is a specific DNS protocol carried within HTTPS. Your browser, operating system, or another application must be configured to use it, and it needs a compatible resolver.
What DoH protects—and what it does not
DoH can protect DNS query contents from observers between the device and its configured resolver. This can be valuable on untrusted local networks and can reduce exposure to a local ISP's DNS infrastructure when you deliberately choose another resolver.
The resolver still sees the queries it handles. A website you visit can still see a connection from your IP address or VPN exit address, depending on your network setup. Other signals, including browser behavior, account sign-ins, and application telemetry, are outside DoH's scope.
DoH also does not replace HTTPS for websites. DNS tells an application where to go; HTTPS protects the connection to the website after it has started. DNSSEC is separate too: it helps validate DNS data but does not encrypt the device-to-resolver connection.
DoH in browsers and managed networks
Some browsers can use DoH independently of the operating system's DNS settings. This can improve privacy for that browser, but it can also surprise a managed school, workplace, or home network that expects DNS filtering, internal names, or troubleshooting tools to see all DNS activity.
Well-designed deployments account for local policy and split DNS. For example, an organization may need internal names to go to an internal resolver rather than a public DoH service. Users should understand which application is selecting the resolver and review its privacy policy rather than assuming encryption answers every trust question.
DoH versus DoT
DNS over TLS (DoT) also encrypts DNS traffic, but it uses a dedicated TLS connection for DNS, commonly on port 853. DoH uses HTTPS, typically sharing the web's HTTP stack and port 443. Neither is universally better: the choice depends on the device, resolver, network policy, and operational needs.
DoH can blend with ordinary HTTPS traffic, which may make simple port-based DNS handling less visible. DoT's dedicated service can be clearer for network operators to identify and manage. Both require trust in the selected resolver.
The takeaway
DoH encrypts DNS requests between a client and resolver by carrying them over HTTPS. It improves privacy on that portion of the path, but the resolver remains a trusted party and it does not replace HTTPS, DNSSEC, or broader privacy practices.
