DNS over HTTPS (DoH): how it works and should it be on?

What DNS over HTTPS is

DNS over HTTPS (DoH) is an IETF standard, RFC 8484, published in 2018. It carries ordinary DNS questions and answers inside HTTPS, the same encrypted protocol used to load secure websites. Microsoft's documentation summarises the benefits as confidentiality (queries and responses are encrypted), integrity (TLS stops them being changed in transit), authentication (the client can check the resolver's certificate) and resistance to traffic analysis, because DNS traffic blends in with other HTTPS traffic.

That last point is the one that matters most to an IT team. Plain DNS runs on port 53 and DNS over TLS has its own port, 853, so a firewall can recognise both. DoH normally uses port 443 and looks like any other web request. A firewall cannot tell a DoH lookup from a visit to a website without knowing the DoH server's name or address.

DoH does not change what DNS answers; it only changes how the question travels. It does not block anything by itself and it does not validate that records are genuine. For blocking you need protective DNS; for proving records are authentic you need DNSSEC.

How a DoH lookup works

In plain steps, when a device uses DoH:

1. The browser or operating system has a DoH resolver configured, identified by a URL template such as https://resolver.example/dns-query.
2. It opens an encrypted TLS connection to that resolver, checking the resolver's certificate in the same way it would for a website.
3. It sends the DNS question inside an HTTPS request (RFC 8484 allows both GET and POST).
4. The resolver answers the question as normal, applying whatever policy it has: none for a plain public resolver, your security and content policy for a protective DNS service.
5. The answer comes back inside the HTTPS response, and the device connects to the address it was given.

Because the connection is reused for many lookups, DoH adds little delay once it is set up. The important question is step 4: whose resolver is answering, and does it apply your policy?

Where DoH appears

DoH has spread from a browser feature into operating systems and apps:

• Google Chrome began rolling out Secure DNS, built on DoH, with Chrome 83 in May 2020. By default it upgrades to DoH only if your current DNS provider offers a DoH service, and it falls back to regular DNS if there is a problem. Users can also choose a provider. Chrome disables Secure DNS when it detects a managed environment through enterprise policies.
• Microsoft Edge has a matching "Use secure DNS" setting under Privacy, search, and services, then Security. Microsoft documents that if its DoH policy is not configured on a managed device, DoH queries are not sent.
• Mozilla Firefox has its own DoH settings and an enterprise policy that can switch DoH on or off, set the provider, lock the setting and exclude domains.
• Windows 11 includes a DoH-capable DNS client, so the whole operating system can encrypt its lookups, not just the browser. Microsoft added DoH to the Windows Server 2025 DNS Server role with its June 2026 security update.
• Apps and malware can carry their own DoH resolvers and ignore the device's DNS settings entirely.

Our page on secure DNS explains what the browser setting does in practice, and why it often appears greyed out on work devices.

Should DNS over HTTPS be on or off?

This is the most common question people search for, and the honest answer depends on whose device it is and where the lookups go.

The NCSC's guidance on protective DNS for the private sector says DoH should either be disabled on client operating systems or configured to go via the protective resolver while still allowing logging. Either is acceptable; what is not acceptable is leaving browsers and apps free to choose their own resolver. For the firewall and policy steps, see should you block DNS over HTTPS?

DNS over HTTPS on Windows 11 and Windows Server

Windows will only use DoH with resolvers it knows support it. Microsoft documents how the Windows DNS client handles DoH in its Windows Server 2022 guidance. Windows 11 is also a DoH-capable client, so check the equivalent settings in the Windows version you run:

• Windows ships with a short list of known public DoH servers. If a device's DNS server is on that list, the DNS settings for that connection let you choose encrypted only, encrypted preferred with unencrypted allowed, or unencrypted only.
• Administrators can add other resolvers, such as a protective DNS service that offers DoH, with the Add-DnsClientDohServerAddress PowerShell cmdlet, giving the resolver's DoH template and whether fallback to unencrypted DNS is allowed.
• A Group Policy setting under Computer Configuration, Administrative Templates, Network, DNS Client lets you allow, prohibit or require DoH. Microsoft documents it as "Configure DNS over HTTPS (DoH) name resolution"; check the exact name in your current administrative templates, as Windows wording changes between releases.
• Microsoft advises against requiring DoH on domain-joined computers, because Active Directory depends on DNS servers that may not answer DoH.

The browser and Windows settings are separate. A browser with its own Secure DNS turned on can use DoH even if Windows does not, which is why browser policies matter as much as the operating system's. Many organisations find it simpler to let a protective DNS agent handle encryption to the resolver; our DNS roaming client guide compares the options.

Can DoH bypass a web filter?

Yes, if it is left unmanaged. A DNS-based filter only sees lookups sent to it. If a browser, app or piece of malware sends its lookups by DoH to a different resolver, the filter does not see them and cannot block them. Because DoH runs on port 443, simply blocking port 53 does not stop it.

Proxy-based web filters and secure web gateways are less affected, because they inspect the web connection rather than the lookup, but they have their own blind spot in Encrypted Client Hello. The robust answer is layered: manage DoH settings on devices, block third-party DoH services by category, use a protective DNS agent on laptops, and test it. Our DNS security test guide includes a DoH bypass check.

Forever Systems can review how DoH is behaving on your network today and help you set policies that keep encryption without losing control. Contact us and we will talk it through; what we deliver is confirmed at quote.