Oblivious DoH (ODoH)
Oblivious DoH (ODoH), defined in RFC 9230, adds a proxy between a DNS client and a DoH resolver (RFC 8484) so the resolver sees an encrypted query but not the client's IP address, and the proxy sees the client's IP but not the query. AdminKit's guide to DoH vs. DoT privacy tradeoffs covers where ODoH fits.
By AdminKit team, Netbase JSC · Updated
Oblivious DoH (ODoH), defined in RFC 9230, is a privacy extension built on top of DNS over HTTPS (RFC 8484) that separates who can see a client’s IP address from who can see the DNS query itself. In plain DoH, the recursive resolver sees both the client’s IP address and the query it’s asking about in the same request. ODoH introduces an oblivious proxy between the client and the target resolver: the client encrypts its query to the target resolver’s public key using HPKE (Hybrid Public Key Encryption) and sends the encrypted blob through the proxy; the proxy forwards it to the resolver without being able to decrypt it, so the proxy learns the client’s IP address but not the query, while the resolver learns the query but only sees the proxy’s IP address as the apparent source. No single party in that chain learns both pieces of information at once. ODoH shares its core cryptographic primitive, HPKE, with Encrypted ClientHello (ECH) — both are recent IETF efforts to reduce the metadata a network observer or intermediary can collect, one for DNS queries and the other for TLS handshake metadata. ODoH’s privacy guarantee depends on the proxy and the target resolver not colluding; if the same operator runs both, the split stops protecting anything.
Oblivious DoH is part of AdminKit’s DNS cluster; the full AdminKit glossary lists other related terms.
Frequently asked questions
What problem does ODoH solve that plain DoH doesn't?
Plain DoH (RFC 8484) still reveals the client's IP address directly to the resolver together with the query it's asking about; ODoH splits that knowledge between a proxy, which sees the IP but not the query, and the resolver, which sees the query but not the client's IP.
What encryption does ODoH use to protect the query from the proxy?
ODoH encrypts the DNS query to the target resolver's public key using HPKE (Hybrid Public Key Encryption), so the oblivious proxy only relays encrypted bytes it cannot itself decrypt.
Does the DNS resolver in ODoH know which client sent a given query?
No -- the resolver only sees the proxy's IP address as the apparent source, since the proxy forwards the query, still encrypted to the resolver's key, on the client's behalf.
Does ODoH require a different resolver than regular DoH?
ODoH is defined as a protocol built on top of DoH (RFC 8484) as its transport, so an ODoH target resolver is still speaking DoH underneath -- it additionally supports the ODoH encryption and proxying layer.