DoH
What is DoH?
DoH (DNS over HTTPS), defined in RFC 8484, sends DNS queries inside an encrypted HTTPS connection instead of plain UDP/TCP port 53, so an ISP or attacker on the network can't read or tamper with which domains are being looked up. AdminKit's DNS resolver test walks you through checking which resolver a connection is actually using.
By AdminKit team, Netbase JSC · Updated
DoH (DNS over HTTPS) sends DNS queries and responses inside an encrypted HTTPS connection instead of the traditional unencrypted UDP/TCP port 53 traffic, so an observer on the network — an ISP, a public Wi-Fi operator, or an attacker — can’t read or tamper with which domains are being looked up. Many modern browsers now enable DoH by default to a chosen resolver, which can bypass network-level DNS filtering or parental controls configured elsewhere on the network, a tradeoff worth knowing about if a device seems to ignore DNS-based blocking. Public resolvers publish their own DoH endpoints: Google Public DNS documents an RFC 8484 endpoint at dns.google/dns-query, supporting both GET and POST, alongside a separate JSON API. Browser-level DoH typically runs independently of the operating system’s own stub resolver configuration, which is why network-level filtering keeps working for every other application on the same device. DoH is defined in RFC 8484, which registers the dns-query path DoH servers use in IANA’s Well-Known URIs registry. DoQ (DNS-over-QUIC), defined in RFC 9250, is a newer, less widely deployed alternative that carries the same kind of encrypted query over QUIC instead of HTTPS.
AdminKit groups doH under its DNS cluster — browse the AdminKit glossary index for other related terms.
Frequently asked questions
Is DoH the same as a VPN?
No -- DoH only encrypts DNS lookups, not your other internet traffic; a VPN encrypts and routes all of your traffic through a separate server, which is a much broader change.
Does enabling DoH bypass parental controls or network-level DNS filtering?
It can -- browser-level DoH often sends queries to a chosen resolver independently of the network's configured DNS, which can bypass filtering set up at the router or network level for that browser's traffic.
What's the difference between DoH and DoT?
Both encrypt DNS queries, but DoH blends them into regular HTTPS traffic, making it harder to block without also blocking other HTTPS, while DoT uses its own dedicated port, 853, which is easier for administrators to identify and manage but also easier to block outright.
How can I tell which DNS protocol my connection is actually using?
AdminKit's DNS resolver test tool shows which resolver and protocol -- plain DNS, DoH, or DoT -- a connection is actually using.