Simple definition
DNS over HTTPS (DoH) carries DNS queries between a client and its configured resolver over an encrypted HTTPS connection.
Technical definition
DoH carries DNS messages over HTTP protected by TLS. It protects the client-to-resolver transport; the chosen resolver can still see the queries, and encryption alone does not validate DNS answers.
Purpose and use
Its purpose is to limit observation or alteration of DNS traffic along that connection.
Practical example
A browser can use its configured DoH resolver instead of the resolver selected by the operating system. Check which resolver the application actually uses.
Common issues
- Enterprise DNS policy bypassed
- Resolver unavailable or incompatible
- Certificate or network connectivity problem
Related terms
Key takeaway: DoH encrypts the DNS transport to a resolver. Resolver trust, DNSSEC validation and enterprise DNS policy remain separate concerns.
Abbreviation
DoH is the abbreviation used for this encrypted DNS transport.
Transport scope
The encrypted connection ends at the configured resolver.
Policy scope
Check the settings used by the client and the policy of the organization.
Resolver selection
Confirm the resolver actually used before comparing results.
Operational checks
Review connectivity and certificate failures without disabling certificate verification.
Related DNS concepts
DNSSEC validates DNS data; encrypted transport addresses a different part of the exchange.