Hiding in the Crowd
Web developers and privacy advocates wanted something harder to block than DoT. Enter DNS over HTTPS (DoH), defined in RFC 8484 (2018).
Instead of creating a new protocol on a new port, DoH treats DNS queries like any other HTTPS web request. It sends the DNS query as an HTTP GET or POST request to a standard HTTPS endpoint — for example, https://cloudflare-dns.com/dns-query.
How it works mechanically:
1. Your browser or OS opens an HTTPS connection to a DoH resolver on port 443 — the same port used for every website.
2. DNS queries are encoded either as URL query parameters (GET) or as binary DNS wire format in the request body (POST), with the content type application/dns-message.
3. The resolver returns the DNS answer as an HTTP response body.
4. From the network's perspective, this traffic is indistinguishable from loading a web page.
Key Characteristics:
| Property | Value |
|---|---|
| Port | 443 (TCP) |
| Encryption | TLS 1.2 or 1.3 (via HTTPS) |
| Query format | DNS wire format over HTTP, or JSON API |
| Visibility | Looks identical to normal web traffic |
| Blockability | Hard — blocking port 443 breaks the entire web |
Use Case: DoH is the standard preferred by web browsers. Firefox enabled DoH by default in the US in 2020. Chrome and Edge followed. The browser-level implementation means DoH can protect users even when the operating system or router is configured to use unencrypted DNS — the browser simply ignores the OS resolver and uses its own.
The camouflage property is a double-edged sword. It is excellent for user privacy and censorship resistance. It is a significant headache for enterprise network administrators who need to inspect or control DNS traffic for security purposes.
A common interview question: "What's the difference between DoH and DoT if both use TLS?" The encryption strength is equivalent — both use TLS. The difference is the transport layer and port. DoT is DNS-over-TLS on port 853 (identifiable, blockable). DoH is DNS-over-HTTPS on port 443 (camouflaged, hard to block). The choice between them is about network observability and censorship resistance, not encryption quality.