DNS-over-HTTPS (DoH) Explained: Architecture, Security, and In-Browser Queries

2026-10-14

The Domain Name System (DNS) was designed in 1983 as an unencrypted, cleartext UDP/TCP protocol operating over port 53. While the web rapidly transitioned to end-to-end encryption via HTTPS (TLS 1.3), traditional DNS requests remained completely visible in plain text. Any network intermediary—your local Wi-Fi router, Internet Service Provider (ISP), or state-level surveillance system—can monitor, log, and manipulate every domain your device contacts.

Standardized by the IETF in RFC 8484, DNS-over-HTTPS (DoH) encrypts DNS queries inside standard HTTP/2 and HTTP/3 HTTPS sessions over port 443. In this deep-dive, we explore how DoH works under the hood, compare it against competing security protocols, and demonstrate how web developers can execute live DNS queries directly in frontend JavaScript.

The Vulnerability of Traditional Port 53 DNS

When you navigate to https://example.com, your browser uses HTTPS to encrypt the webpage payload. However, before that connection begins, your operating system sends an unencrypted query to port 53:

Client ----[ Plaintext UDP Port 53: "What is example.com?" ]----> ISP DNS Resolver
Anyone on the wire can inspect the domain name, inject forged IP addresses (DNS Spoofing),
or redirect users to malicious phishing servers (DNS Hijacking).

Because port 53 is distinct, network operators and firewalls can easily identify, throttle, or block specific DNS requests.

How DNS-over-HTTPS (DoH) Works (RFC 8484)

DoH packages DNS wire-format messages (or modern JSON endpoints) inside standard HTTPS requests sent to port 443. To an outside observer on the network, a DoH request is indistinguishable from standard secure web traffic:

  • Port Blending: Uses standard port 443 alongside all HTTPS traffic, preventing selective blocking without severing the user's entire web access.
  • TLS Authentication: Uses TLS certificates to verify the identity of the DNS resolver (e.g. Cloudflare 1.1.1.1 or Google 8.8.8.8), eliminating man-in-the-middle spoofing.
  • HTTP/2 & HTTP/3 Multiplexing: Multiple DNS requests can share an established TCP/QUIC socket, cutting handshake latency for subsequent queries.

Protocol Comparison: DoH vs DoT vs DNSSEC

Protocol Port Encryption Eavesdropping Protection Censorship Resistance
Standard DNS 53 (UDP/TCP) None Zero (Cleartext) Poor (Trivially blocked)
DNSSEC 53 (UDP/TCP) Signing only (No privacy) Zero (Queries visible) Guarantees integrity, not privacy
DNS-over-TLS (DoT) 853 (TCP) TLS Encryption High Medium (Port 853 easily blocked)
DNS-over-HTTPS (DoH) 443 (HTTPS) TLS 1.3 / QUIC High High (Blends with web traffic)

Querying DNS Records Directly in JavaScript via DoH

Traditionally, web browsers could never query DNS records (such as MX mail records, TXT verification strings, or CNAMEs) because JavaScript in the browser cannot open raw UDP sockets on port 53. With DoH, any browser can query DNS using standard fetch()!

async function queryDoH(domain, recordType = 'A') {
  // Cloudflare DoH JSON endpoint
  const url = new URL('https://cloudflare-dns.com/dns-query');
  url.searchParams.set('name', domain);
  url.searchParams.set('type', recordType);

  const response = await fetch(url.toString(), {
    headers: {
      'Accept': 'application/dns-json'
    }
  });

  if (!response.ok) {
    throw new Error('DoH query failed with status: ' + response.status);
  }

  const data = await response.json();
  // Status 0 indicates NOERROR (successful resolution)
  if (data.Status === 0 && data.Answer) {
    return data.Answer.map(record => ({
      name: record.name,
      type: recordType,
      ttl: record.TTL,
      data: record.data
    }));
  }
  return [];
}

// Example usage:
queryDoH('github.com', 'A').then(records => console.log('GitHub IPs:', records));
queryDoH('google.com', 'MX').then(records => console.log('Google MX:', records));

Try the Online DoH DNS Lookup Tool

Want to query DNS records right now from your own browser without terminal commands or dig? Use our free DoH DNS Lookup & Record Checker. It queries Cloudflare and Google DoH resolvers in real time to inspect A, AAAA, MX, TXT (SPF/DMARC), CNAME, and NS records. For network diagnostics, also check our My IP & Headers Info and Domain Safety Checker.

← Back to Blog