The Mechanism of Encrypted DNS: Why DNS over HTTPS is Replacing DNS over TLS

When a network engineer monitors traffic on a standard enterprise router in 2026, the most revealing data does not come from the payloads of intercepted files. It comes from Port 53. Every time a user types a web address into their browser, the machine fires a plaintext User Datagram Protocol (UDP) packet into the network, asking a Domain Name System (DNS) resolver to translate the human-readable name into an IP address.

Even if the resulting website connection is secured by military-grade encryption, that initial query is entirely visible. Anyone on the network path—from the local coffee shop Wi-Fi administrator to the regional Internet Service Provider—can read the exact domain being requested, logging the user's intent before the encrypted session even begins.

This structural leak, known as the QNAME vulnerability, has functioned as the internet's primary surveillance mechanism for over thirty years. Because traditional DNS queries are unencrypted, ISPs routinely harvest them to build behavioral profiles, while authoritarian governments use them to enforce national firewalls.

The Internet Engineering Task Force (IETF) recognized that securing the web required closing this gap, leading to the development of two competing cryptographic standards: DNS over TLS (DoT) and DNS over HTTPS (DoH). Both protocols achieve the same fundamental goal of encrypting the query, but their architectural differences have sparked a bitter conflict between privacy advocates and network administrators.[1][2]

DNS over TLS, formalized by the IETF in 2016 under RFC 7858, takes a direct approach to the problem. It establishes a dedicated, persistent Transport Layer Security (TLS) tunnel between the user's device and the DNS resolver. All queries flow through this encrypted pipe on Port 853. For network administrators, DoT represents an acceptable compromise.

The contents of the queries are hidden from passive eavesdroppers, but the traffic itself is easily identifiable because it uses a specific, dedicated port. If a corporate firewall needs to enforce a policy that all devices must use the company's internal DNS resolver, the administrator can simply block outbound traffic on Port 853, forcing devices to fall back to the monitored local network.[2]

DNS over HTTPS, defined two years later in RFC 8484, takes a radically different, stealth-oriented approach. Instead of creating a dedicated channel, DoH wraps the DNS query inside a standard HTTP request and transmits it over Port 443—the exact same port used by all secure web traffic.

To an outside observer, a DoH query is mathematically indistinguishable from a user loading a standard web page, fetching an image, or streaming a video. Because it blends seamlessly into the background noise of the internet, blocking DoH requires blocking all HTTPS traffic, which effectively breaks the modern web. This makes DoH highly resistant to censorship, but it entirely blinds local network administrators.[1]

The technology industry has decisively thrown its weight behind the stealth approach. Major browser vendors, including Google Chrome, Mozilla Firefox, and Microsoft Edge, have integrated DoH natively, often enabling it by default for users in the United States and Europe. By moving DNS resolution into the browser itself, these companies bypass the operating system's network stack entirely.

This shift strips ISPs of their visibility into user behavior, preventing them from monetizing DNS data or easily enforcing court-ordered content blocks. Consequently, ISPs have been the primary opponents of DoH deployment, arguing that routing queries to third-party resolvers like Cloudflare or Google degrades performance and breaks localized content delivery networks.

The primary engineering criticism of encrypted DNS has always been latency. Traditional DNS over Port 53 operates on a zero-round-trip-time (0-RTT) basis; the client fires a UDP packet and receives an immediate response. Cryptography requires negotiation. DNS over TLS requires a TCP handshake followed by a TLS handshake, adding two full round trips before the first query can be sent.

DNS over HTTPS adds yet another layer, wrapping the payload in HTTP framing, which historically required three round trips. In a system where human perception notices delays above 100 milliseconds, adding cryptographic overhead to every single web request threatened to make the internet feel sluggish.

However, real-world performance data has largely debunked the latency argument for users on optimized networks. Measurements conducted by network intelligence firm ThousandEyes revealed that Cloudflare's DoH implementation returned an average resolution time of 25.2 milliseconds, compared to 23.4 milliseconds for its unencrypted Do53 service.

The 1.8-millisecond penalty is entirely imperceptible to human users. This parity is achieved through connection multiplexing. Once the initial HTTP/2 or HTTP/3 connection is established, the browser keeps the secure tunnel open, allowing hundreds of subsequent DNS queries to be fired through the existing pipe without repeating the cryptographic handshake.[3]

That seamless performance, however, is highly dependent on dense, localized infrastructure. The privacy overhead of DoH is not a fixed protocol constant; it is deeply regressive. An extensive global measurement study published by the Asia Pacific Network Information Centre (APNIC) in February 2022 exposed a massive disparity in encrypted DNS performance based on regional wealth.

While users in North America and Western Europe see negligible delays, the cryptographic handshake inflates dramatically where Points of Presence (PoPs) are sparse. The APNIC researchers noted a stark reality: 'Consumers in an economy with a low GDP are twice as likely to experience a slowdown compared to consumers in an economy with a high GDP.'[4]

In the most infrastructure-poor regions, the theoretical privacy upgrade becomes a functional bottleneck. The APNIC data showed that in the lowest-tier economies, median DoH resolution times spiked to over 1,000 milliseconds—a full second of delay just to translate the domain name, before the actual website data even begins to load.

When a user in these regions clicks a link, the browser must negotiate a TCP connection and a TLS handshake with a resolver that might be located on another continent. The speed of light and the realities of global routing turn a 1.8-millisecond penalty into a crippling delay, forcing users to choose between privacy and usability.[4]

Beyond the geographic performance divide, DoH faces fierce resistance from enterprise security teams. Corporate networks rely on DNS filtering to block malware domains, prevent phishing attacks, and stop data exfiltration. Because DoH bypasses the local network's DNS resolver and encrypts the traffic, traditional security appliances cannot inspect the queries.

An employee's compromised laptop could use DoH to quietly request the IP address of a command-and-control server, and the corporate firewall would only see a standard HTTPS connection to a major provider like Google or Cloudflare. To regain control, many enterprises have resorted to deploying endpoint agents directly on employee machines to intercept queries before they are encrypted.

Even with DoH fully deployed, a secondary privacy leak remains in the TLS handshake itself. When a browser connects to a secure website, it must tell the server which certificate to present using the Server Name Indication (SNI) extension. Historically, the SNI field was transmitted in plaintext, meaning that even if the DNS query was hidden by DoH, the ISP could still read the domain name during the subsequent TLS connection.

To close this final loophole, the IETF developed Encrypted Client Hello (ECH), a protocol that encrypts the SNI data using a public key obtained via the DoH query. When DoH and ECH are used together, the network path is completely blinded to the user's destination.

The transition to encrypted DNS represents the most significant architectural shift in internet privacy since the universal adoption of HTTPS. While DNS over TLS offered a cleaner engineering solution, the industry's pivot to DNS over HTTPS demonstrates that evasion is now prioritized over cooperation.

By hiding infrastructure requests inside application traffic, browser vendors have successfully outmaneuvered network operators. The remaining challenge is entirely physical: until dense edge-compute networks expand into developing economies, the cryptographic privacy afforded by DoH will remain a luxury strictly reserved for regions with the infrastructure to support it.