AnyProxy

Get Pro
Glossary · Web tech

DNS-over-HTTPS

Also calleddohdns over httpsencrypted dns
Definition

DNS over HTTPS (DoH) sends your DNS lookups inside an encrypted HTTPS connection, so the network in between can neither read nor rewrite the answers.

Explanation

In depth

Ordinary DNS is plain text on port 53. Your ISP can see every name you look up and can answer with whatever it likes. DoH, standardised as RFC 8484 in 2018, wraps the same question in HTTPS and sends it to a resolver you choose, such as Cloudflare at 1.1.1.1 or Google at 8.8.8.8. To the network it looks like ordinary encrypted web traffic on port 443. Firefox, Chrome, Edge and Windows 11 all support it. It is a direct fix for the most common block in OONI's data: an ISP replying with a fake address. Examples are Iran's 10.10.34.36 answer for vimeo.com on Mobinnet in October 2026 and TurkNet's 195.175.254.2 for YouTube in September 2025. DoH changes nothing else. Your browser still names the site in the TLS handshake (the SNI field), so a network that filters by SNI, or by the site's IP address, still cuts the connection after the lookup succeeds. Some networks also block well-known DoH resolvers. DoH protects the lookup; a web proxy or VPN changes the connection itself.

In practice

DNS-over-HTTPS in the real world

Which block DoH beats is visible in OONI's raw data. On 14 Oct 2026 an Iranian probe on Mobinnet (AS50810) got 10.10.34.36 for vimeo.com from its system resolver. DoH to an outside resolver would have returned Vimeo's real address. On Irancell, though, OONI found connections reset right after the TLS ClientHello, when the site name is sent. That block happens after DNS, so DoH alone leaves the page blocked. Know which layer you are dealing with before you count on DoH.

Sources: RFC 8484 — DNS Queries over HTTPS · OONI measurement: vimeo.com on Mobinnet AS50810, 14 Oct 2026 (DNS answer 10.10.34.36) · OONI — Iran censorship study (2025)

Questions about DNS-over-HTTPS

Is DNS over HTTPS enough to unblock sites?
Only when the block is DNS-only. If the network also filters by SNI or by IP address, the lookup succeeds and the connection is still cut.
What is the difference between DoH and DoT?
Both encrypt DNS. DoH (RFC 8484) uses port 443 and looks like web traffic. DNS over TLS (RFC 7858) uses its own port, 853, which a network can block in one rule.
Do I need DoH when I use a web proxy?
Not for the proxied sites: the proxy server does those lookups itself. DoH still helps your other browsing and the lookup of the proxy's own name.

Related terms

DNSDNS is the system that turns a site name such as vimeo.com into the numeric IP address your device actually connects to.TLS SNISNI (Server Name Indication) is the field at the start of an HTTPS connection where your browser names the site it wants, usually in readable text.ESNI / ECHEncrypted Client Hello (ECH) encrypts the opening message of an HTTPS connection, hiding the real site name (SNI) from the network; it replaced the earlier ESNI draft.DNS filteringDNS filtering blocks a website by making the address lookup fail or point somewhere else, so your browser never reaches the real server.

Put the concept to work

Try AnyProxy free — no install, no signup, six regions.

Open a blocked page