DoH (DNS over HTTPS) (DoH)

DNS over HTTPS wraps DNS queries inside standard HTTPS requests. Traditional DNS sends queries in plaintext over UDP port 53, which means anyone on the network path (ISPs, coffee shop wifi, corporate proxies) can see exactly which domains you're looking up and even modify the responses. DoH encrypts all of that inside a normal HTTPS connection.

The protocol is simple. The client sends a DNS query as an HTTP request to a resolver's URL (like https://cloudflare-dns.com/dns-query or https://dns.google/dns-query). The query can be sent as a GET request with the DNS message base64url-encoded in a parameter, or as a POST with the binary DNS message in the body. The response comes back as an application/dns-message content type.

Browsers drove DoH adoption. Firefox was first, enabling DoH by default for US users in 2020 with Cloudflare as the default resolver. Chrome, Edge, and Safari followed with support but different defaults. When a browser uses DoH, it bypasses the OS DNS resolver entirely. This means network-level DNS filtering (like corporate content filters or parental controls) stops working unless the DoH resolver also provides filtering.

For CDN performance, DoH matters in two ways. First, CDN DNS resolvers (Cloudflare 1.1.1.1, Google 8.8.8.8) offer DoH endpoints. Users resolving through these get fast, encrypted lookups that can't be tampered with. Second, the resolver sees the user's real IP (via EDNS Client Subnet or the source IP of the HTTPS connection), which helps CDN DNS return the geographically closest edge server.

The main criticism of DoH is centralization. Traditional DNS is distributed: your ISP, your company, your home router all run resolvers. DoH concentrates queries at a few big providers (Cloudflare, Google, Quad9). This gives those providers visibility into massive amounts of DNS traffic. Proponents argue this is still better than ISPs selling DNS data or governments tampering with responses.

DoH uses standard HTTPS infrastructure. It benefits from HTTP/2 multiplexing (multiple queries over one connection), connection reuse, and standard TLS encryption. It also blends in with normal web traffic on port 443, making it harder to block than DoT (which uses the distinctive port 853).