For most of the internet's life, DNS lookups traveled in plain text. Anyone on the network path, your internet provider, a coffee-shop router, could see every domain you looked up, and could tamper with the answers. DNS over HTTPS (DoH) and its cousin DNS over TLS (DoT) close that gap by encrypting the lookup. It is a good thing for privacy, but it quietly changes how filtering and troubleshooting work, and that is worth understanding whether you run a website or just want to know what your browser is doing.
What DoH and DoT actually do
Both wrap your DNS queries in encryption so the network in between cannot read or change them.
- DNS over HTTPS (DoH) sends DNS queries inside normal HTTPS traffic, on port 443, so they look like any other web request. Browsers like Chrome and Firefox can do this on their own, sometimes without the operating system knowing.
- DNS over TLS (DoT) encrypts DNS on its own dedicated port (853). It is more common at the operating-system or network level than inside a single app.
- Either way, the resolver you send the query to still sees what you asked. Encryption hides the lookup from the network in between, not from the resolver answering it. Choosing a resolver you trust still matters.
What changes when DNS is encrypted
Encrypted DNS is mostly invisible until it interacts with filtering or troubleshooting, and then it surprises people.
- Provider and network filtering can be bypassed. If a network blocks sites by returning bad answers on its own resolver, a browser using DoH to an outside resolver skips that resolver entirely. This is why regional or network DNS blocking sometimes stops working the moment someone turns on DoH.
- Company and parental filters may break. The same mechanism that protects privacy can route around a filter an office or a household relies on. Many managed networks now detect and disable DoH for that reason.
- Troubleshooting gets confusing. Your operating system and your browser can be using two different resolvers at once. A domain can look fine in a command-line lookup (which uses the OS resolver) and behave differently in the browser (using DoH). When results disagree, check both. See clearing the right cache.
What it means for your website and email
Here is the reassuring part: DoH changes how visitors look up your domain, not what your domain publishes.
- Your DNS records are unchanged. Encrypted DNS is about the transport between a visitor and their resolver. Your A, AAAA, MX, and TXT records work exactly the same. Keep them correct and complete; see DNS record types.
- Email authentication is unaffected. SPF, DKIM, and DMARC are TXT-record lookups that any resolver performs normally, encrypted or not. Keep SPF, DKIM, and DMARC in order.
- Propagation still applies. A change still has to reach resolvers worldwide. Confirm it with a propagation check.
Should you turn it on?
For personal browsing, encrypted DNS to a reputable resolver is a sensible privacy upgrade. On a managed office network, coordinate with whoever runs filtering first, because DoH can silently defeat it. As a site owner, you do not need to do anything special: publish correct records and let visitors resolve them however they choose.
The one thing to remember
DoH and DoT encrypt the path between a visitor and their resolver, which improves privacy and can bypass network-level filtering, but it does not touch the records your domain publishes. If lookups disagree between your terminal and your browser, encrypted DNS in the browser is usually why. Confirm your own setup any time with a full DNS test.