What is DNS over HTTPS

DNS over HTTPS (DoH) is a security protocol for performing remote Domain Name System (DNS) resolution via the HTTPS protocol. It is a method for increasing user privacy and security by preventing eavesdropping and manipulation of DNS data by man-in-the-middle attacks.

Traditionally, DNS queries are sent in plain text (unencrypted) over UDP or TCP, which means anyone along the path of the query can see what websites you’re requesting and possibly manipulate the response to direct you to a different IP address. DoH aims to solve these problems by sending DNS queries and getting DNS responses over a secure HTTPS connection instead.

Here’s a basic rundown of how it works:

1. Your browser (or other DoH-compatible client) makes a DNS query to a DoH-compatible DNS server. Instead of sending the query as plain text over UDP or TCP, it sends it as an HTTPS request. This means the query is encrypted, so anyone monitoring the network can’t see what website you’re asking the DNS server about.

2. The DoH-compatible DNS server receives your query, decrypts it, and processes it just like a normal DNS query.

3. The DNS server then sends the response (the IP address associated with the domain name you queried) back to your browser over HTTPS, so the response is also encrypted.

DoH is an important tool in the ongoing effort to encrypt the entire internet and preserve users’ privacy and security.

DNS over HTTPS (DoH) is a valuable tool in enhancing internet privacy and security, but it also has its potential drawbacks.

Let’s list some of the pros:

1. **Enhanced Privacy:** By encrypting DNS queries, DoH ensures that third parties cannot easily monitor the websites you’re visiting, providing a significant boost to your online privacy.

2. **Improved Security:** DoH protects against certain types of attacks, such as DNS spoofing or man-in-the-middle attacks, where an attacker might try to redirect your traffic to a malicious website.

3. **Bypassing DNS-Based Content Filters or Blocks:** Since DoH makes it harder for ISPs or other network administrators to see DNS queries, it can potentially bypass content filters or blocks that are implemented at the DNS level.

Cons of DoH:

1. Potential Conflicts with Network Security Measures: Many network security tools rely on being able to monitor DNS queries to identify malicious activity. DoH could potentially interfere with these tools, making it harder for network administrators to maintain security.

2. Centralization Concerns: A significant number of users might end up using DoH servers run by a small number of large companies, leading to centralization. This could potentially give these companies a lot of insight into users’ browsing habits, even though the data is encrypted.

3. Bypassing of Local DNS Policies: In environments where DNS is used for content filtering or policy enforcement, DoH can bypass these protections, leading to potential security or compliance issues.

4. Increased Load on Web Servers: DoH uses HTTPS, which is more resource-intensive than traditional DNS. This could potentially result in additional load on servers, although this would likely be mitigated by efficient server software and hardware.

As always, it’s important to consider these pros and cons in the context of your specific situation when deciding whether to use DoH. It’s a valuable tool for privacy and security, but like any technology, it’s not a silver bullet and has its own potential downsides.