The Problem with Traditional DNS
Every time you type a web address into your browser, your device sends a DNS query — essentially asking "what is the IP address for this domain?" to a DNS server. By default, this query is sent in plain text, meaning your Internet Service Provider (ISP), network administrator, or anyone else monitoring the network can see exactly which domains you're looking up.
This is precisely how many government-mandated website blocks work: the ISP's DNS server is configured to return no result (or a block page) for banned domains. Your browser never even gets the IP address it needs to connect.
Enter DNS-over-HTTPS (DoH)
DNS-over-HTTPS (DoH) solves this by encrypting your DNS queries and sending them over HTTPS — the same secure protocol used by websites. Because the queries look like regular encrypted web traffic, they are:
- Hidden from your ISP and network administrator
- Protected from tampering and interception
- Routed to a trusted DNS resolver of your choice (not your ISP's)
The result is that DNS-based blocks are effectively bypassed — your encrypted query reaches a public resolver that responds with the correct IP address, and your browser can connect to the site normally.
How to Enable DoH in Your Browser
In Google Chrome
- Go to Settings → Privacy and Security → Security.
- Scroll down to "Use secure DNS".
- Toggle it on and select a provider (e.g., Google, Cloudflare, or a custom one).
In Mozilla Firefox
- Go to Settings → General → Network Settings → Settings.
- Check "Enable DNS over HTTPS".
- Choose a provider or enter a custom DoH URL.
In Microsoft Edge
- Go to Settings → Privacy, search, and services → Security.
- Toggle on "Use secure DNS to specify how to lookup the network address for websites".
- Choose your preferred DNS provider.
Recommended Public DoH Resolvers
| Provider | DoH URL | Logs Policy |
|---|---|---|
| Cloudflare | https://cloudflare-dns.com/dns-query | No query logging |
| https://dns.google/dns-query | Temporary logging | |
| NextDNS | Custom URL per account | Configurable |
| AdGuard DNS | https://dns.adguard.com/dns-query | No logging |
Limitations of DoH
While DoH is a powerful tool, it's not a silver bullet:
- IP-level blocks still apply: If a site's IP address is blocked (not just its domain), DoH alone won't help. You'll need a VPN or proxy in addition.
- Some governments block DoH providers: Countries with heavy censorship may block access to known DoH server IP addresses.
- Doesn't encrypt your actual traffic: DoH only encrypts the DNS lookup — not the content of your browsing. Use HTTPS websites for that.
- Centralizes DNS queries: By using a single DoH provider, you're shifting your trust from your ISP to that provider. Choose one with a clear, audited no-logs policy.
DoH vs. Other Bypass Methods
- DoH — Best for bypassing DNS-level blocks easily, with no extra software.
- VPN — Best for comprehensive privacy and bypassing all types of blocks.
- Tor — Best for high-anonymity needs; slower but highly resistant to blocking.
- Mirror links — Best when a specific domain is blocked but the service is still accessible via alternate URLs.
Should You Enable DoH Right Now?
For most users, the answer is yes. Enabling DoH in your browser is a quick, free, and effective way to improve DNS privacy and bypass common filtering mechanisms. It takes less than a minute to set up and requires no additional software. Combined with HTTPS browsing and an awareness of mirror links, DoH forms an important layer of a broader open-internet toolkit.