DNS translates a domain name into an address. Traditional DNS queries may travel without encryption, allowing nearby networks or providers to observe or alter them. DNS over HTTPS (DoH) sends those queries inside an HTTPS connection to a chosen resolver.
The protection boundary
DoH protects the query between the device and resolver. The resolver still receives it, and connecting to the resulting server creates other metadata. DoH does not replace website HTTPS and does not make a browser anonymous.
Choose the resolver deliberately
Review the provider's retention, filtering and jurisdiction policies. Moving DNS from an ISP to another company changes who handles queries; it does not eliminate trust.
Managed networks
Schools and workplaces may use DNS filtering to stop malware or enforce policy. Overriding an approved resolver can remove those protections and violate device rules. Use the administrator's process for false positives.
When DoH helps
It is useful against local DNS observation and tampering on networks you control or where policy permits it. Keep browser, operating system and resolver settings aligned so troubleshooting does not become guesswork.
Bootstrap and fallback deserve attention
A browser still needs a route to the DoH resolver, and behavior during resolver failure varies. Check whether the client fails closed, falls back to ordinary DNS or follows operating-system policy. A setting labelled “secure” may prioritize availability unless strict mode is selected.
Troubleshoot in layers
If a name fails, compare the browser's secure-DNS status, the operating-system resolver and the authoritative DNS record. Do not disable HTTPS or certificate validation to work around a DNS problem. On managed networks, use the approved configuration because split-horizon internal names may not exist on a public resolver.
DoH protects the lookup transport; it does not hide the destination from every observer, inspect malicious pages or replace encrypted web connections.