Encrypted DNS still leaves someone you have to trust

Before a browser connects to a site, it needs to resolve the domain name to an IP address. Traditional DNS often sends that lookup in plaintext to a resolver provided by the network, making it visible to observers on the path. DNS over HTTPS (DoH) carries the DNS query and response inside an HTTPS connection to a configured resolver. The IETF’s RFC 8484 standard defines that protocol; Mozilla’s Firefox documentation describes how the browser can send lookups to a DoH-compatible resolver instead of the local one.

This protects the query from ordinary on-path observers such as someone monitoring public Wi-Fi. It does not encrypt every part of the web visit, hide the destination IP address from the network, or make the user anonymous. The resolver that receives the query can still see it. Choosing a DoH provider therefore changes which operator handles the lookup and whose retention and privacy practices matter.

For example, if a laptop uses a hotel’s local DNS but the browser is configured to send DoH to another provider, the hotel may no longer see the queried domain in the same way. The external resolver now receives the lookup, and local filtering or parental-control rules that depended on the hotel’s DNS may not apply. Mozilla notes that DoH can bypass local DNS policies and provides controls for users and administrators to disable or configure it when those policies matter.

On a managed work or school device, follow the organization’s DNS setup rather than selecting an arbitrary public resolver. At home, consider whether the resolver’s privacy policy, filtering features and reliability suit the household. DoH is most useful when its destination is deliberate and its policy consequences are understood. The protocol protects a data path; it cannot decide whether a resolver retains queries, filters malicious domains or merits user trust. For privacy, assess both the encrypted connection and the party operating its endpoint.