# DNS Over HTTPS: What It Protects and What It Does Not

> DNS over HTTPS encrypts resolver queries but does not hide every destination or replace HTTPS, a VPN or safe browsing decisions.

- Canonical article: [https://www.metacyber.guru/articles/dns-over-https-guide](https://www.metacyber.guru/articles/dns-over-https-guide)
- Category: Browser Privacy
- Author: Muhammad Azhar
- Published: August 14, 2026
- Last reviewed: 2026-08-14

DNS translates a domain name into an address. Traditional DNS queries may travel without encryption, allowing nearby networks or providers to observe or alter them. DNS over HTTPS (DoH) sends those queries inside an HTTPS connection to a chosen resolver.

## The protection boundary

DoH protects the query between the device and resolver. The resolver still receives it, and connecting to the resulting server creates other metadata. DoH does not replace website HTTPS and does not make a browser anonymous.

## Choose the resolver deliberately

Review the provider's retention and filtering policy. Moving DNS from an ISP to another company changes who handles queries; it does not eliminate trust.

## Managed networks

Schools and workplaces may use DNS filtering to stop malware or enforce policy. Overriding an approved resolver can remove those protections and violate device rules. Use the administrator's process for false positives.

## When DoH helps

It is useful against local DNS observation and tampering on networks you control or where policy permits it. Keep browser, operating system and resolver settings aligned so troubleshooting does not become guesswork.

## Bootstrap and fallback deserve attention

A browser still needs a route to the DoH resolver, and behavior during resolver failure varies. Check whether the client fails closed, falls back to ordinary DNS or follows operating-system policy. A setting labelled “secure” may prioritize availability unless strict mode is selected.

## Troubleshooting clue

If internal company names stop resolving while public sites work, an independent browser resolver may be bypassing the corporate DNS view. Restore the managed setting instead of adding hard-coded addresses.

## Resolver choice becomes a trust decision

DoH hides ordinary DNS queries from the local network, but the selected resolver can still receive them. Compare retention, filtering and jurisdiction policies before changing providers. A browser may use a different resolver from the operating system, which can complicate parental controls and enterprise incident response.

## Troubleshoot in layers

If a name fails, compare the browser's secure-DNS status, the operating-system resolver and the authoritative DNS record. Do not disable HTTPS or certificate validation to work around a DNS problem. On managed networks, use the approved configuration because split-horizon internal names may not exist on a public resolver.

DoH protects the lookup transport; it does not hide the destination from every observer, inspect malicious pages or replace encrypted web connections.

## Sources and further reading

- [Mozilla: DNS over HTTPS](https://support.mozilla.org/en-US/kb/firefox-dns-over-https)
- [IETF RFC 8484: DNS Queries over HTTPS](https://www.rfc-editor.org/rfc/rfc8484)

---

This Markdown edition is provided for language-model retrieval. The canonical human-readable page is the HTML article linked above.