What is DNS over HTTPS (DoH)? How it works and how to enable it

DNS over HTTPS (DoH) encrypts the DNS lookups your device makes: the question of which IP address belongs to a name like ljpc-hosting.nl. With DoH, your internet service provider and anyone else on the same network can no longer see which sites you look up or tamper with the answers on the way. You enable it in your browser, in Windows, Android, on your iPhone or on your router, using a DNS service that supports it, such as Google, Cloudflare, Quad9 or DNS4EU.

This guide explains what DoH is and how it works, how it compares with DNS over TLS (DoT), what it does and does not protect, which DoH URLs the major resolvers use, and how to turn on DNS over HTTPS on each device and check that it works.

What is DNS over HTTPS (DoH)?

Every time you open a website or an app fetches data, your device first asks a DNS server, the resolver, for the IP address behind the name. Classic DNS sends that question unencrypted over port 53. Anyone between you and the resolver can read which names you look up: the operator of a public Wi-Fi network, your ISP or someone eavesdropping on the network. In principle they can also send back a forged answer and steer you to a fake website.

DoH sends the same DNS query through an encrypted HTTPS connection on port 443, the same way traffic to a secure website travels. The resolver proves its identity with a certificate, and nobody along the way can read or change the query or the answer. DoH has been an internet standard since 2018, RFC 8484.

How DNS over HTTPS works

1. You open a website. Your browser or operating system needs the IP address for the name.
2. It opens an encrypted connection to the DoH resolver, for example https://dns.google/dns-query, and checks the resolver's certificate.
3. The DNS query travels encrypted to the resolver, which finds the answer in its cache or asks the domain's nameservers.
4. The answer comes back encrypted and your browser connects to the website. The connection to the resolver stays open, so later lookups do not need a new one.

DoH encrypts the path between your device and the resolver. Beyond that, between the resolver and a domain's nameservers, DNS usually still travels unencrypted. That part is protected by DNSSEC, which lets the resolver verify with digital signatures that an answer really comes from the domain owner.

DoH vs DoT and other encrypted DNS protocols

DNS over TLS and DNS over HTTPS offer the same protection. The main difference is how the traffic looks on the network.

DoT runs on its own port, 853, so a network administrator can see that it is DNS and allow or block it. DoH uses port 443 and blends in with other HTTPS traffic, which makes it harder to single out and block. That is why browsers chose DoH, while routers and Android often use DoT. Since a Google Play system update in 2022, Android 11 and later use DNS over HTTP/3, a faster form of DoH, with well-known resolvers that support it, according to Google.

What DNS over HTTPS protects, and what it does not

DoH is a real privacy improvement, especially on networks you do not control. It helps to know where the protection ends.

DoH protects against

• Snooping on the network. On hotel, train or café Wi-Fi and at your ISP, the names you look up are no longer visible.
• Forged answers in transit. A device on the network can no longer slip you a fake IP address, because the answer is encrypted and comes from the resolver.

DoH does not hide

• Your queries from the resolver. The service you pick sees every DNS query, so you move your trust from your ISP to that service. How Google, Cloudflare, Quad9 and DNS4EU handle your data is covered in public DNS vs ISP DNS servers.
• IP addresses. Your ISP can still see which servers you connect to.
• The site name in the HTTPS handshake. At the start of an HTTPS connection your browser often still sends the site name in readable form (SNI). Encrypted Client Hello (ECH) encrypts that name too, but only when both your browser and the website support it.
• The rest of your traffic. DoH is not a VPN: your IP address and other traffic stay as they are.
• Malware and phishing. Encryption alone blocks nothing. A filtering resolver such as Quad9 or DNS4EU Protective does stop known malicious domains.

DoH URLs of popular public resolvers

A DoH service is identified by a URL; DNS over TLS uses a hostname. You will need these in the steps below. We tested all four in November 2026.

The IP addresses, filtering variants and privacy policies of these services are listed in public DNS vs ISP DNS servers. To find out which one answers fastest from your connection, run a DNS benchmark. DNS4EU says its public service is meant for individuals, not organisations.

How to enable DNS over HTTPS

You can enable DoH in your operating system, where it covers every app on the device, or in your browser, where it covers only that browser. Write down the current setting before you change anything so you can always switch back.

Windows 11

1. Open Start, Settings and choose Network & internet, then your connection: Wi-Fi or Ethernet.
2. Next to DNS server assignment, click Edit and choose Manual.
3. Turn on IPv4 and enter your resolver's IP address under Preferred DNS, for example 9.9.9.9 for Quad9.
4. Under DNS over HTTPS, choose On (automatic template). Windows knows the DoH URLs of Google, Cloudflare and Quad9, among others, and fills them in. For another service, such as DNS4EU, choose On (manual template) and enter the URL from the table.
5. To make sure Windows never falls back to unencrypted DNS, turn off Fallback to plaintext. Repeat for the alternate DNS server and for IPv6, then click Save.

Android

1. Open Settings, tap Network & internet and then Private DNS. On a Samsung phone, search Settings for Private DNS.
2. Select Private DNS provider hostname.
3. Enter your resolver's DoT hostname from the table, for example dns.google, and tap Save.

Private DNS applies to Wi-Fi and mobile data. In Automatic mode, Android only encrypts DNS when the network's DNS server supports it.

iPhone, iPad and Mac

Apple has no field in Settings for a DoH URL. You set up encrypted DNS with a configuration profile or an app from your DNS provider. Quad9 and DNS4EU offer profiles for iPhone and iPad, and Cloudflare offers the 1.1.1.1 app. To install a profile on an iPhone:

1. Open your provider's setup page in Safari and download the profile, for example from Quad9's guide.
2. Open Settings and tap Profile Downloaded at the top.
3. Tap Install, enter your passcode and confirm the notice that your network traffic goes through the DNS server.

You can review or remove the profile later under Settings, General, VPN & Device Management. On a Mac, open the downloaded profile and finish the installation in System Settings. Safari has no DoH setting of its own and follows the system. Since iOS 16 and macOS Ventura, Apple devices also switch to encrypted DNS automatically when your network's DNS server advertises support for it (Discovery of Designated Resolvers, RFC 9462).

Chrome and Edge

1. In Chrome, click More at the top right, then Settings, and on the left Privacy and security, Security.
2. Under Advanced, turn on Use secure DNS.
3. Keep your current service provider or pick another one from the list. If yours is not listed, enter its URL from the table as a custom provider.

By default Chrome's secure DNS runs in automatic mode: it uses DoH when your current DNS service supports it and falls back to classic DNS otherwise. If you choose a provider yourself, Chrome does not fall back, Google explains. On a managed device or with parental controls the setting is not available. In Edge, type edge://settings/privacy in the address bar and turn on Use secure DNS under Security.

Firefox

1. Open Settings, choose Privacy & Security and scroll to DNS over HTTPS.
2. Choose a protection level, then pick your resolver under Choose provider or enter a custom URL.

In Firefox's redesigned settings the options are Default protection, Custom and Off. Custom always uses secure DNS and lets you set the provider and the fallback behaviour.

Router

Some routers encrypt DNS for your whole network, usually with DNS over TLS. A FRITZ!Box has an option for encrypted name resolution (DNS over TLS) in its DNS server settings, where you enter your resolver's DoT hostname. If your ISP's router does not offer encrypted DNS, enable it per device or per browser instead.

How to check that DoH is working

• Cloudflare: open one.one.one.one/help. Using DNS over HTTPS (DoH) shows Yes when you reach Cloudflare over DoH.
• Quad9: on.quad9.net shows whether you are using Quad9.
• Firefox: the DNS over HTTPS section shows the status, for example Active, and the provider in use.
• Command line: dig 9.18 and later can send a DoH query, for example dig @dns.google +https ljpc-hosting.nl. Use +tls instead of +https to test DNS over TLS.

DNS over HTTPS in a business network or security policy

On a business network you usually want all DNS to go through one resolver that you can filter and log. A browser that runs its own DoH bypasses it. To stay in control:

• Pick one encrypted resolver and configure it on every device, so company laptops are protected on the road too.
• Manage browsers by policy: DnsOverHttpsMode and DnsOverHttpsTemplates in Chrome and Edge, the DNSOverHTTPS policy in Firefox. In Windows, the Group Policy setting Configure DNS over HTTPS (DoH) name resolution sits under Network, DNS Client.
• Tell Firefox your network filters DNS. If your resolver returns no address (NXDOMAIN) for the canary domain use-application-dns.net, Firefox does not enable DoH in Default Protection.

If your security policy says resolvers use DNS over HTTPS where possible, also record which resolver that is and how you stop devices from choosing another one. How malware abuses DNS to move data out unseen, and why one controlled resolver helps, is explained in what is DNS tunneling.

What LJPc hosting takes care of

DoH happens between your visitors and their resolver. Your website and email at LJPc hosting are reachable for everyone, with or without encrypted DNS:

• Reachable through any resolver. When your domain uses our nameservers, ns1, ns2 and ns3.ljpc.network give the authoritative answer for it. Every resolver fetches it there, whether a visitor uses DoH or not. There is nothing for you to configure.
• DNSSEC switched on automatically. When your domain is registered with us and uses our nameservers, we turn on DNSSEC for you. Together with DoH the whole path is covered: DoH between visitor and resolver, DNSSEC between resolver and our nameservers. You can see it in a DoH query to Google: curl -s -H "accept: application/dns-json" "https://dns.google/resolve?name=yourdomain.com&type=A" returns "AD":true when the signatures validate.
• HTTPS for your website. Every web hosting plan includes free SSL, and visitors who arrive over http are redirected to https by default. After the lookup, the connection to your site is encrypted as well. More in SSL certificates explained.

You manage your DNS records in Plesk or in the customer portal at portal.ljpc.nl; see manage DNS records. If your domain does not behave as expected, troubleshoot DNS problems walks you through it, or create a support ticket and we will look into it with you.