What is DNS over HTTPS?
DNS over HTTPS (DoH) is a protocol that encrypts DNS queries by sending them inside standard HTTPS connections instead of as unencrypted plaintext. Every time you type a website address, your device asks a DNS server to translate that domain name into an IP address. Traditionally, this request travels in the clear, meaning your ISP, network administrator, or anyone on the same Wi-Fi network can see exactly which websites you are requesting. DoH wraps those queries in the same HTTPS encryption that protects your banking and shopping sessions, making your browsing habits invisible to third-party observers.
In-Depth
The Privacy Problem with Traditional DNS
Standard DNS uses UDP port 53 with no encryption. When you visit “example.com,” your computer sends a plaintext request to a DNS resolver that says, effectively, “What is the IP address of example.com?” Anyone monitoring the network – a coffee-shop eavesdropper, a corporate firewall, or your ISP – can log every domain you look up. This metadata reveals your browsing patterns even when the websites themselves use HTTPS. A VPN encrypts all traffic including DNS, but DoH provides a lighter-weight, DNS-specific solution that works without the overhead of a full VPN tunnel.
DoH vs. DoT (DNS over TLS)
DoH is not the only DNS encryption protocol. DNS over TLS (DoT) achieves the same goal but uses a dedicated port (853) with TLS encryption. The practical difference:
- DoH (port 443): Uses the same port as all HTTPS web traffic, making it indistinguishable from normal browsing. Difficult for network administrators to block without breaking web access entirely.
- DoT (port 853): Uses a distinct, identifiable port that is easier for firewalls to detect and block.
Major browsers – Chrome, Firefox, Edge, Brave, and Safari – have adopted DoH as their preferred DNS encryption method because of its resistance to blocking and its seamless integration with the existing web stack.
Performance Impact
A common concern is whether encrypting DNS adds latency. In practice, the overhead is minimal. The initial HTTPS handshake takes a fraction of a second, and subsequent queries reuse the connection (HTTP/2 multiplexing), making them as fast as or faster than traditional DNS over UDP. Measurements by Cloudflare and Google show that DoH latency is comparable to conventional DNS in most network conditions. In some cases, switching to a high-performance DoH provider like Cloudflare (1.1.1.1) actually speeds up DNS resolution compared to a slow ISP resolver, because the provider’s infrastructure is geographically closer to most users.
How to Enable DoH
Enabling DoH is simple:
- In your browser: Open Settings, navigate to Privacy or Security, find “Use secure DNS” or “DNS over HTTPS,” and select a provider (Cloudflare, Google, Quad9, etc.).
- At the OS level: Windows 11, macOS, iOS, and Android all support system-wide DoH. In your network or DNS settings, enter a DoH-compatible server address and enable the encryption option.
- On your router: Some routers support DoH or DoT, encrypting DNS for every device on your network without per-device configuration.
Considerations and Limitations
DoH is not a silver bullet for privacy. It encrypts the DNS query, but the IP address you subsequently connect to is still visible to your ISP and network operator (unless you also use a VPN). Additionally, Server Name Indication (SNI) in the TLS handshake can reveal the hostname you are connecting to; Encrypted Client Hello (ECH) is an emerging standard that addresses this. Some enterprise networks and parental-control systems rely on inspecting DNS queries to enforce policies. Enabling DoH on a corporate network may bypass security controls, so check with your IT department before enabling it on a work device.
How to Choose
1. Start with Your Browser
The fastest way to get DoH protection is to enable it in your browser’s settings. It takes about 30 seconds, requires no software installation, and immediately encrypts all DNS lookups made by that browser.
2. Pick a Trustworthy DNS Provider
When you use DoH, you are trusting the DNS provider with your query data. Choose carefully:
- Cloudflare (1.1.1.1): Commits to not selling data and purging query logs within 24 hours. Independently audited.
- Google Public DNS (8.8.8.8): Extremely fast and reliable; logs are anonymized but retained for limited analytics.
- Quad9 (9.9.9.9): Security-focused; blocks known malicious domains automatically.
Review each provider’s privacy policy and choose the one whose data practices align with your comfort level.
3. Combine with a VPN for Full Protection
DoH encrypts only DNS queries – it does not hide your IP address or encrypt the rest of your traffic. For comprehensive privacy on public Wi-Fi or in restrictive network environments, pair DoH with a VPN. Together, they cover both the “what site are you visiting” question (DoH) and the “what are you doing there” question (VPN).
DoH Adoption and Industry Momentum
DoH has gained rapid adoption since its introduction. Firefox was the first major browser to enable DoH by default (in the US), followed by Chrome, Edge, and Brave. Apple added system-wide DoH support in iOS 14 and macOS Big Sur. Windows 11 supports DoH natively in network settings. This broad adoption means that enabling DoH is no longer an advanced technical task – it is a mainstream feature supported by every major platform. The trend toward encrypted DNS is clear and irreversible, driven by both user demand for privacy and industry consensus that unencrypted DNS is a liability.
Recommended Products
DNS over HTTPS is primarily a software/settings feature built into modern browsers and operating systems — but dedicated network devices make it automatic for every device on your network. The picks below range from free software configuration to hardware solutions that enforce DoH for the whole home. For full network privacy, pair with a VPN service.
| Product | Highlights | Price Tier |
|---|---|---|
| Firewalla Purple | Home network security box, DoH/DoT for all devices, no subscription | Mid-range |
| GL.iNet GL-MT3000 (Beryl AX) | Travel router, built-in DNS-over-HTTPS, WireGuard VPN, Wi-Fi 6 | Mid-range |
| ASUS ZenWiFi Pro ET12 | Wi-Fi 6E mesh, built-in DNS-over-HTTPS in ASUS router firmware | Premium |
Firewalla Purple — Best Network-Wide DoH Device
Our Top Pick. The Firewalla Purple is a compact home network security device that connects to your existing router and enforces DNS over HTTPS for every device on your network — smartphones, smart TVs, IoT gadgets — without any per-device configuration. Simply set your preferred DoH provider (Cloudflare, Quad9, NextDNS, or custom) in the Firewalla app, and all DNS queries from every device are instantly encrypted and routed through it. Beyond DoH, Firewalla provides ad blocking, intrusion detection, bandwidth monitoring, and parental controls from the same device with no monthly subscription fee. For households that want network-wide privacy protection without reconfiguring each device individually, the Firewalla Purple is the most comprehensive and user-friendly solution available.
GL.iNet GL-MT3000 (Beryl AX) — Best Travel Router with DoH
Privacy on the road. The GL.iNet GL-MT3000 (Beryl AX) is a pocket-sized Wi-Fi 6 travel router that has built-in DNS-over-HTTPS support in its OpenWrt-based firmware. Configure your DoH provider in the web interface, connect the router to hotel or café Wi-Fi, and all your devices automatically get encrypted DNS without any per-device setup. The same router also supports WireGuard and OpenVPN, so you can layer DoH with a VPN in a single device. Wi-Fi 6 speeds reach 2.4 Gbps on the 5 GHz band, fast enough to saturate any hotel internet connection. For frequent travelers who want private, consistent DNS in any network environment, the GL-MT3000 packs enterprise-level network privacy into a device that fits in a jacket pocket.
ASUS ZenWiFi Pro ET12 — Best Whole-Home Mesh with DoH
Whole-home coverage with built-in privacy. The ASUS ZenWiFi Pro ET12 is a tri-band Wi-Fi 6E mesh system with built-in DNS-over-HTTPS support in the ASUS router firmware (ASUSWRT). Navigate to the DHCP settings, enter your preferred DoH server URL, and the router encrypts DNS queries for every device on the network automatically. The ET12 delivers Wi-Fi 6E speeds across up to 7,400 sq ft with the two-node kit, supports 160 MHz channels for low-latency gaming and 4K streaming, and includes ASUS AiProtection Pro for threat detection powered by Trend Micro. For homes that want high-performance Wi-Fi 6E coverage alongside network-level DoH, the ET12 delivers both without requiring a separate security appliance.
See Full Wifi Router Comparison →
The Bottom Line
DNS over HTTPS is one of the easiest and most impactful privacy upgrades you can make. By encrypting the DNS queries that reveal which websites you visit, DoH closes a long-standing gap in internet privacy – and it takes less than a minute to enable. Choose a reputable DNS provider, turn on DoH in your browser or operating system, and consider layering a VPN on top for full-spectrum protection. It is a small change with a meaningful payoff.