How DoH works
Ordinary DNS queries travel as plain text, so your provider or any node on the path can see which sites you request. DoH wraps the same query in an HTTP message and sends it over TLS encryption on port 443 — the same port as normal web traffic. From the outside, a request to the resolver is indistinguishable from loading a regular page.
What DoH gives you
Encrypting queries brings several benefits at once:
- Privacy — the provider no longer sees the list of domains you request.
- Tamper protection — the answer cannot be silently altered in transit.
- Stealth — the traffic blends in with ordinary HTTPS instead of standing out as a separate stream.
A similar approach is DoT (DNS over TLS): it also encrypts queries but uses a dedicated port 853, whereas DoH hides them inside web traffic.
