DNS Over HTTPS: Why It Matters for Home Privacy

DNS translates human-readable domain names (google.com) into IP addresses (142.250.80.46). Every website visit sends a DNS query. These queries were historically sent in plain text — anyone on the network could read them, revealing every site you visit.

DNS over HTTPS (DoH) encrypts these queries. Understanding what this means in practice helps you make informed decisions.

The Historical Problem

Traditional DNS is plain text:

- Your ISP sees every website lookup

- Anyone on your network sees your DNS queries

- Attackers can tamper with DNS responses

- Surveillance tools can log DNS activity

Pre-DoH, HTTPS protected content of web activity but not destinations. Someone watching DNS could see you visited bank-of-america.com even without seeing what you did there.

What DoH Changes

**Your ISP cannot see DNS queries.** They see encrypted traffic to a DNS provider instead of plaintext.

**Public WiFi operators cannot see queries.** Same protection on untrusted networks.

**DNS tampering becomes much harder.** Encrypted DNS prevents man-in-the-middle attacks.

**Your DNS provider now sees queries instead of ISP.** Trust shifts from ISP to DNS provider.

What DoH Does Not Change

**Your actual IP connections remain visible.** After DNS resolution, you connect to destination IPs. ISP and network observers still see which IPs, usually revealing the website.

**HTTPS traffic contents stay encrypted either way.**

**Trackers across sites still work.** Cookies and fingerprinting unaffected by DNS encryption.

**Your DNS provider sees queries.** You moved the risk from ISP to DNS provider.

Choosing a DNS Provider

**Cloudflare (1.1.1.1).** Fast, free, commits to not using DNS data for advertising, 24-hour log retention. Good performance and reasonable privacy.

**Quad9 (9.9.9.9).** Non-profit based in Switzerland, blocks known malicious domains, strong privacy stance. Slightly slower but preferred for privacy.

**Google (8.8.8.8).** Fast and reliable but ties data to Google's advertising business. Not recommended for privacy.

**NextDNS.** Configurable with filtering options, per-device analytics only you can see, reasonable pricing.

**Mullvad DNS.** Free, no account required, no logging. Operated by VPN provider but usable independently.

**Your ISP's DNS.** Default. Has whatever logging policy your ISP has, often not favorable.

Recommended: Cloudflare for performance, Quad9 for stronger privacy stance.

How to Enable DoH

**Browser-level:**

- Chrome: Settings → Privacy and Security → Security → Use secure DNS

- Firefox: Settings → General → Network Settings → Enable DNS over HTTPS

- Edge: Settings → Privacy, Search, and Services → Security → Use secure DNS

**OS-level:**

- Windows 11: Settings → Network & Internet → DNS server assignment

- macOS: System Settings → Network → Advanced → DNS

- iOS: Install DNS profile from provider

- Android: Settings → Network & Internet → Private DNS

**Router-level:** Some advanced routers support DoH, protecting all devices.

OS-level is better than browser-level because it protects all apps. The ideal is OS-level plus browser-level as redundancy.

The ISP Reaction

ISPs vary in response. Some actively lobbied against DoH (Comcast). ISPs opposing DoH typically have business reasons for wanting to see your queries. This reinforces the privacy case for using DoH.

The Captive Portal Problem

Captive portals on public WiFi sometimes do not work with DoH enabled because they need to intercept DNS queries to redirect you to sign-in page.

Most modern DoH implementations handle this by detecting captive portal networks and temporarily disabling DoH during authentication. If captive portal does not appear, temporarily disable DoH, authenticate, re-enable.

Business Network Consideration

Enterprise networks sometimes inspect DNS for legitimate security reasons. For employer-managed devices, enabling DoH may violate corporate security policies. Check with IT before enabling on work devices.

Practical Recommendation

For home users:

**Enable OS-level DoH** using Cloudflare, Quad9, or NextDNS.

**Enable browser-level DoH** as backup.

**Consider router-level DoH** if your router supports it.

**Choose trustworthy provider.** Cloudflare for performance, Quad9 for privacy stance.

**Avoid Google's DNS** given advertising business alignment.

**Test captive portals still work** on networks you use.

The DNS over HTTPS transition is one of the quiet but substantial privacy improvements of recent years. Enabling it provides real privacy benefits with minimal downside.