What Is DNS-over-HTTPS
DNS-over-HTTPS (DoH) is a protocol that encrypts your DNS queries by sending them inside standard HTTPS connections. Instead of sending plaintext DNS requests over UDP port 53 (the default), your device sends encrypted HTTPS requests to port 443 — the same port used by secure websites.
When you type a website address into your browser, the first step is always a DNS lookup to find the server's IP address. With plain DNS, this request travels in plaintext that anyone can read. With DoH, the request is wrapped in HTTPS encryption, making it unreadable to your ISP, network administrators, or anyone monitoring your connection. The result: your browsing activity stays private.
DoH uses the same encryption technology (TLS 1.3) that protects online banking, shopping, and other sensitive activities. It was standardized in RFC 8484 in 2018 and is now supported by all major browsers and operating systems. For a complete overview, see our DoH complete guide.
How DoH Works
Here is the step-by-step process of how DNS-over-HTTPS encrypts your DNS queries.
Step 1: Your Device Sends a DNS Query
When you visit a website like example.com, your device needs to find its IP address. With DoH enabled, instead of sending a plaintext UDP packet to port 53, your device creates an HTTPS request to your DoH provider's endpoint.
Step 2: The HTTPS Connection Encrypts the Query
The DNS query is packaged inside an HTTPS request — the same type of connection used by secure websites. The query travels over TLS 1.3 encryption to the DoH provider's server. Your ISP sees an HTTPS connection to a known IP address (like Cloudflare's 1.1.1.1), but cannot read the contents of the request.
Step 3: The DoH Provider Resolves the Query
The DoH provider receives the encrypted request, decrypts it, looks up the IP address for example.com, and sends the response back encrypted over the same HTTPS connection. The provider processes millions of these queries per second using its global network of edge servers.
Step 4: Your Device Connects to the Website
Your device receives the IP address and connects to example.com. The website loads normally. The entire DNS resolution took milliseconds, and the encryption overhead was negligible (1-3 ms).
The key insight is that DoH uses the same port (443) and protocol (HTTPS) as regular website traffic. Your ISP cannot easily distinguish DoH queries from normal HTTPS browsing. This makes it much harder for network operators to block or monitor encrypted DNS compared to DNS-over-TLS, which uses a dedicated port (853).
DoH vs Plain DNS
Plain DNS and DoH differ in three critical ways: encryption, privacy, and censorship resistance.
Encryption
Plain DNS sends queries in plaintext over UDP. Anyone monitoring your connection can read every domain you request. DoH wraps DNS queries in TLS 1.3 encryption, making them unreadable. The encryption overhead is 1-3 ms per query, which is imperceptible.
Privacy
With plain DNS, your ISP logs every domain you visit. In many countries, ISPs are legally required to retain these logs for months or years. With DoH, your ISP can see that you are making HTTPS connections to a DNS provider, but it cannot see which domains you are looking up. The provider you choose (Cloudflare, Google, etc.) sees your queries but commits to privacy policies. See our best DNS for privacy guide.
Censorship Resistance
Plain DNS is easily blocked or redirected by ISPs, governments, or network operators. DoH is much harder to block because it uses port 443 — the same port as HTTPS websites. Blocking port 443 would break the entire internet, so ISPs cannot selectively block DoH without disrupting all HTTPS traffic.
The comparison is clear: DoH provides identical performance with dramatically better privacy. There is no reason to use plain DNS in 2026. See our DoT vs DoH comparison for more details.
Browser Support (Firefox, Chrome, Edge, Safari)
All major browsers support DNS-over-HTTPS. Here is how to enable it in each.
Firefox
Firefox has DoH enabled by default since 2020. It uses Cloudflare as the default DoH provider. To verify or change: open Settings, scroll to Network Settings, click Settings, scroll to DNS over HTTPS. You can choose "Increased Protection" (Cloudflare or NextDNS) or "Max Protection" (strict DoH with no fallback). Firefox supports custom DoH URLs if you want to use a different provider.
Chrome
Chrome supports DoH but does not enable it by default. To enable: open Settings, go to Privacy and Security, click Security, scroll to "Use secure DNS," toggle it on, and select a provider or enter a custom URL like https://1.1.1.1/dns-query. Chrome uses your OS DNS settings when DoH is off, and switches to the configured provider when enabled. See our DoH setup guide.
Edge
Microsoft Edge supports DoH natively. Open Settings, go to Privacy, Search, and Services, scroll to Security, enable "Use secure DNS," and select a provider or enter a custom DoH server. Edge shares the same Chromium DoH implementation as Chrome. See our DoH guide for details.
Safari
Safari supports DoH starting with iOS 14 and macOS Big Sur. Enable it in Settings: on iOS, go to Wi-Fi, tap the info icon next to your network, tap Configure DNS, and select a DoH provider. On macOS, go to System Settings, Network, select your connection, click Details, go to DNS, and configure. Safari also supports Apple's iCloud Private Relay, which provides additional DNS encryption. See our private DNS guide.
After enabling DoH in your browser, run our DNS leak test to verify your queries are encrypted and not going to your ISP's DNS server.
Router-Level DoH
Enabling DoH at the router level encrypts DNS for every device on your network — including smart TVs, gaming consoles, and IoT devices that cannot configure DoH individually. This is the most comprehensive approach.
Router Firmware Support
Many modern routers now support DoH or DoT natively in their firmware. ASUS routers support DoH through their AiProtection feature. Linksys routers with recent firmware support encrypted DNS in the DNS settings. Netgear routers with Armor or recent firmware support DoH. Check your router admin page for DoH or encrypted DNS options under WAN or Internet settings.
Router-Level Setup
Access your router admin page (usually 192.168.1.1 or 192.168.0.1), log in, find DNS settings, and look for DoH or "Encrypted DNS" options. Enter the DoH endpoint URL for your provider: https://1.1.1.1/dns-query for Cloudflare, https://dns.google/dns-query for Google, or https://dns.quad9.net/dns-query for Quad9. Save and reboot the router.
Alternative: Router with Pi-hole or AdGuard Home
If you run Pi-hole or AdGuard Home on your router (or a local server), you can configure them to forward DNS queries using DoH to your chosen provider. This gives you both local filtering and encrypted upstream queries. See our complete DNS guide for advanced configurations.
After enabling router-level DoH, run our DNS leak test from any device on the network to confirm all DNS traffic is encrypted.
Frequently Asked Questions
What is DNS-over-HTTPS?
DNS-over-HTTPS (DoH) is a protocol that encrypts DNS queries by sending them inside HTTPS connections on port 443. Instead of sending plaintext DNS requests to your ISP on UDP port 53, your device sends encrypted HTTPS requests to a trusted DNS provider like Cloudflare or Google. This prevents your ISP, network administrators, and anyone monitoring your connection from seeing which websites you visit.
Does DoH slow down browsing?
DoH adds approximately 1-3 milliseconds of overhead per DNS query compared to plain DNS. This is negligible for browsing. In practice, using a fast DoH provider like Cloudflare (1.1.1.1/dns-query) often results in faster overall browsing than a slow ISP DNS without encryption, because Cloudflare's 300+ edge locations deliver lower latency than most ISP resolvers. The encryption overhead is far outweighed by the speed advantage of using a well-provisioned public DNS resolver.
Can my ISP still see I am using DoH?
Your ISP can see that you are making HTTPS connections to a DNS provider's IP address on port 443. However, it cannot read the contents of those connections, including which domain names you are looking up. A sophisticated ISP could infer you are using encrypted DNS based on the destination IP, but it cannot see your actual DNS queries. This is a significant improvement over plain DNS, where every query is visible in plaintext.
Is DoH supported in my browser?
DoH is supported natively in Firefox (enabled by default since 2020), Chrome, Edge, Brave, Opera, and Vivaldi. Safari supports DoH starting with iOS 14 and macOS Big Sur. All major browsers allow you to configure a custom DoH provider. You can also enable DoH at the operating system level on Windows 11, macOS, Linux, Android, and iOS, which covers all browsers and apps on the device.
Test Your DNS Speed
After enabling DoH, run our free DNS speed test to verify your encrypted resolver and measure its performance.
Run DNS Speed Test
Want to learn more? Read our complete DNS guide, compare DoH and DoT, check our DNS leak test, or find the best DNS for privacy.