{"post":{"slug":"dns-over-https-explained-2026","title":"DNS over HTTPS Explained in 2026: What It Actually Protects","excerpt":"DNS over HTTPS encrypts the lookups that turn domain names into IP addresses. Here is what it hides from your ISP, what it does not hide, and whether you should turn it on.","category":"tech","date":"July 6, 2026","author":"ByteLedger Team","content":"<span class=\"dropcap\">D</span>NS over HTTPS, usually shortened to DoH, wraps your domain name lookups inside an encrypted HTTPS connection instead of sending them as plain text. Every time you type a web address, your device has to ask a DNS resolver \"what IP address is this domain at\" before it can connect. Traditionally that question and answer traveled unencrypted, which meant your internet provider, and anyone else on the network path, could see a plain list of every domain you looked up, even if the page content itself was encrypted with HTTPS.\n\n## What changed in 2026\n\n- **DoH is now the default in most consumer browsers**, not an opt-in setting buried in advanced preferences. Chrome, Firefox, and Edge all ship it turned on with a fallback resolver already configured.\n- **Operating systems caught up.** Windows and Android both added system-level DoH support, so the protection now applies outside the browser too, to apps that use the OS resolver.\n- **ISPs and some governments pushed back.** Because DoH moves DNS control away from the network operator, several regions have debated or passed rules requiring ISPs to be able to inspect or block DNS traffic, which conflicts with DoH by design.\n- **DNS over QUIC (DoQ) started gaining adoption** as a faster alternative that gets similar privacy benefits with less connection overhead than DoH.\n\n## How DNS over HTTPS actually works\n\nNormally, DNS queries go out over port 53 in plain text, using a protocol built in the 1980s with no encryption in mind. DoH instead sends the same query as an HTTPS request to a resolver that supports it, over port 443, the same port normal web traffic uses. That has two effects: the query content is encrypted, and the traffic is harder for a network operator to distinguish from regular web browsing, since it looks like any other HTTPS connection.\n\n## What DoH hides and what it does not\n\nThis is the part most explainers get wrong. DoH protects the DNS lookup step specifically. It does not make you anonymous.\n\n- **Hidden:** the plain-text list of domains you look up, from your ISP or anyone snooping the local network.\n- **Not hidden:** the destination IP address you ultimately connect to, which is visible in your network traffic regardless of DNS encryption.\n- **Not hidden:** the domain name in the TLS handshake itself, unless you also use encrypted client hello (ECH), a separate and newer protection.\n- **Not hidden:** your activity from the DNS resolver you chose — Cloudflare, Google, or whoever you picked can still see everything you look up.\n\n## DoH vs DNS over TLS vs plain DNS\n\n| Method | Encrypted | Port | Blockable by network admins |\n| --- | --- | --- | --- |\n| Plain DNS | No | 53 | Easily |\n| DNS over TLS (DoT) | Yes | 853 (dedicated) | Yes, by blocking the port |\n| DNS over HTTPS (DoH) | Yes | 443 (shared with web traffic) | Hard, without breaking other HTTPS |\n\nDoT is functionally similar to DoH in the privacy it provides, but it uses a dedicated port, which makes it trivial for a network administrator or firewall to block outright. DoH's use of the standard HTTPS port is a deliberate design choice that makes selective blocking much harder.\n\n## Should you turn it on\n\nFor most people, leaving the browser default enabled is a reasonable choice with essentially no downside. The tradeoffs to actually think about:\n\n- **On a managed corporate or school network**, DoH can break local DNS filtering and security tools that rely on inspecting DNS traffic. Many organizations disable it deliberately for this reason.\n- **Choosing a resolver matters more than turning DoH on.** If you route encrypted DNS through the same company that already tracks your browsing, you have not gained much privacy, just moved who can see it.\n- **DoH is not a substitute for a VPN** if your goal is hiding your IP address or browsing activity from your ISP entirely. It closes one specific leak, not the whole picture.\n\n## FAQ\n\n**Does DoH slow down browsing?**\nMarginally, and usually not noticeably. The first connection to a new domain has a small added latency from the encrypted handshake, but most browsers cache results aggressively enough that it is not a practical concern.\n\n**Can my ISP still see what sites I visit if I use DoH?**\nThey can see the IP addresses you connect to and the TLS handshake details unless you also use encrypted client hello, but they can no longer read the plain-text DNS query itself.\n\n**Is Cloudflare or Google a safe default DoH resolver?**\nBoth publish privacy policies limiting data retention, but you are still trusting a single company with your lookup history. If that concerns you, several privacy-focused resolvers exist as alternatives.\n\n**Does DoH work with a VPN kill switch?**\nThey solve different problems and can be used together. A VPN kill switch, covered in our [guide to VPN kill switches](/blog/what-is-a-vpn-kill-switch-2026), stops all traffic if your VPN drops; DoH just encrypts the DNS layer.\n\n## Where to go next\n\n- [What is a VPN kill switch in 2026](/blog/what-is-a-vpn-kill-switch-2026)\n- [Data broker opt out in 2026](/blog/data-broker-opt-out-2026)\n- [2FA app vs SMS in 2026](/blog/2fa-app-vs-sms-2026)","hue":305,"metaTitle":"DNS over HTTPS Explained 2026","metaDescription":"DNS over HTTPS explained for 2026 — what DoH encrypts, what it does not hide, how it differs from DNS over TLS, and whether to enable it.","keywords":["dns over https 2026","what is doh","dns over https vs dns over tls","encrypted dns explained","is dns over https safe","dns privacy 2026","how to enable doh","dns over https browser settings"],"tldr":["**DNS over HTTPS (DoH) encrypts your domain lookups** — your ISP can no longer read the plain-text list of every site you visit at the DNS level.","**It does not hide which sites you visit from everyone** — the site itself, your VPN provider if you use one, and your browser still know.","**Most major browsers enable it by default now** — Chrome, Firefox, and Edge all ship DoH with a preset resolver, often Cloudflare or Google.","**Centralizing DNS with one resolver has a tradeoff** — you are trusting that one company with a complete record of your lookups instead of your ISP.","**Skip:** assuming DoH makes you anonymous online — it only encrypts one layer of a request; TLS handshakes and IP addresses still leak the destination to your network."],"readTime":"4 min read","wordCount":878},"related":[{"slug":"what-is-two-factor-authentication-2026","title":"What Is Two-Factor Authentication in 2026: 2FA Explained","excerpt":"A plain-language explanation of what two-factor authentication is in 2026, how a second login step blocks stolen passwords, the different 2FA methods ranked by safety, and how to set it up.","category":"tech","date":"June 23, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":260},{"slug":"what-is-incognito-mode-2026","title":"What Is Incognito Mode in 2026: Private Browsing Explained","excerpt":"A plain-language explanation of what incognito mode is in 2026, what private browsing actually hides, what it does not hide, and when it genuinely helps versus when it gives a false sense of privacy.","category":"tech","date":"June 10, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":290},{"slug":"end-to-end-encryption-explained-2026","title":"End-to-End Encryption Explained in 2026: What It Protects","excerpt":"End-to-end encryption keeps messages readable only by sender and recipient, not the service carrying them. Here is what it actually protects in 2026, and what it does not.","category":"tech","date":"July 1, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":310}],"sameCategory":[{"slug":"ev-charging-at-home-2026","title":"EV Charging at Home: What the Install Actually Involves","excerpt":"The charger is the cheap part. What determines cost and feasibility is your electrical panel, the cable run, and whether your supply can carry another large load.","category":"tech","date":"August 19, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":232},{"slug":"microled-vs-oled-2026","title":"MicroLED vs OLED: What the Wait Is Actually For","excerpt":"MicroLED promises OLED contrast without burn-in at far higher brightness. Here is why it is still not affordable, and what OLED did in the meantime.","category":"tech","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":235},{"slug":"nas-buying-guide-2026","title":"NAS Buying Guide: Sizing Storage You Will Not Outgrow","excerpt":"A network attached storage box is a small always-on server. Here is how to size drives and bays, why RAID is not a backup, and what actually matters in the specs.","category":"tech","date":"August 19, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":225},{"slug":"nvme-endurance-explained-2026","title":"NVMe Endurance: Will Your SSD Actually Wear Out?","excerpt":"Drive endurance ratings sound alarming and rarely constrain real use. Here is how to read the specification and what actually kills drives.","category":"tech","date":"August 19, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":251}],"newer":{"slug":"distributed-tracing-explained-2026","title":"Distributed Tracing in 2026: How It Actually Works","excerpt":"Distributed tracing follows a single request as it moves across dozens of microservices, showing exactly where time is spent. Here is how it works and how to actually get value from it.","category":"code","date":"July 6, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":320},"older":{"slug":"ethernet-cable-categories-explained-2026","title":"Ethernet Cable Categories Explained 2026: Cat5e to Cat8","excerpt":"Cat5e, Cat6, Cat6a, Cat7, Cat8 — the labels on ethernet cable packaging promise more speed for more money, but most homes do not need the fastest option. Here is what each category actually gets you in 2026.","category":"tech","date":"July 6, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":240}}