Explainer

DNS-over-HTTPS, and what it actually changes

DoH encrypts the conversation between your device and your resolver. That is a real and useful change — and a narrower one than most descriptions imply.

The problem it solves

Classic DNS travels in cleartext over UDP or TCP port 53. Anyone positioned on the path — the operator of the Wi-Fi you joined, your internet provider, anyone running a device between you and the resolver — can read every name your device looks up, and can tamper with the answers. This is not a theoretical weakness; cleartext DNS has been used for both surveillance and redirection for as long as it has existed.

DNS-over-HTTPS, specified in RFC 8484, carries the same DNS messages inside an ordinary HTTPS request. The query and the answer are encrypted and authenticated, and the traffic is difficult to distinguish from other web traffic.

What it hides

The names you look up are no longer readable by observers between you and your resolver.
Those observers can no longer silently rewrite an answer to send you somewhere else.
Because the traffic looks like HTTPS, blocking it selectively is harder than blocking port 53.

What it does not hide

This is the part usually left out.

Your resolver still sees everything. DoH encrypts the link to the resolver; it does not hide anything from the resolver. You are choosing who gets to see your lookups, not removing the audience.
The connection that follows is still visible. After the lookup you connect to the resolved address. The destination IP is visible to your network, and in most cases the hostname is visible in the TLS handshake’s server name indication. Encrypting DNS alone does not conceal which sites you visit.
It is not a VPN and not anonymity. It changes one hop of one protocol.
It does not make anything faster by itself. DoH adds TLS and HTTP framing on top of a DNS message. Where a DoH endpoint is measurably quick, that is the provider’s network and connection reuse doing the work, not the encryption.

DoH, DoT and DoQ

DNS-over-TLS (DoT) encrypts DNS on its own dedicated port, 853. It is equally private in practice and easier for a network operator to identify and block, because it is not mixed in with web traffic. Android’s “Private DNS” setting is DoT, not DoH — a detail that matters when you are following a guide.

DNS-over-QUIC (DoQ) carries DNS over QUIC. Support is less widespread; where it exists it avoids some of the head-of-line blocking inherent in TCP.

All three protect the same hop against the same observers. Which one is available to you usually depends on your operating system and browser rather than on a considered preference.

Where DoH gets configured, and why that matters

DoH can be enabled in three quite different places, and they do not do the same thing:

In the browser. Only that browser’s lookups are encrypted. Everything else on the device keeps using the system resolver.
In the operating system. Windows 11 and recent macOS, iOS and Android releases can use encrypted DNS system-wide, so every application benefits.
On the router. The hop from your router to the internet is encrypted; the hop from each device to the router is not.

This distinction is also why our benchmark is careful about its own claims. It measures browser DoH requests, which is one of these three paths — not the classic port 53 service your operating system uses when you type an IP address into a network settings panel. See how it works for the full description of what is and is not measured.

Should you turn it on?

On a network you do not control — public Wi-Fi, a hotel, a conference — encrypted DNS meaningfully reduces what the local network can see and change. On your own connection the benefit is narrower: it moves visibility from your ISP to whichever resolver operator you chose. That is a reasonable thing to want, provided you have actually decided you prefer that operator’s policies. It is not a reason to expect a faster connection.

Last reviewed 2026-08-15. Provider configuration comes from RESOLVER-REGISTRY.json, which records the official source and verification date for every entry.