DNS over HTTPS (DoH)

DNS over HTTPS (DoH) protects DNS messages between a client and an authenticated HTTPS resolver. The resolver can still see queries, and network metadata can remain visible. It does not guarantee anonymity or resistance to blocking. DNS over TLS provides a related encrypted transport. See RFC 8484 for the security and privacy boundaries.

DoH protects the confidentiality and integrity of lookups, which is a real privacy win, but it is not the same as routing DNS through a tunnel. If you use a VPN, sending DNS through the tunnel is what prevents a DNS leak; DoH complements that by encrypting the lookups themselves, useful especially when you are not on a VPN. Note that the DoH resolver still sees your queries, so choosing a trustworthy one matters. Pair encrypted DNS with tunnel routing for defence in depth rather than treating either as a complete solution on its own.

Choose a resolver you trust, since it still sees your queries, and remember DoH protects the lookup, not your IP. On a VPN, the primary defence against a DNS leak is routing DNS through the tunnel; layer DoH on top for confidentiality, and combine it with encrypted SNI to remove the hostname signal in the handshake. Treat encrypted DNS as one layer in a stack rather than a standalone privacy solution.