DNS over HTTPS (DoH) Explained

Publish on: Classify at:
Words: 500 Read:≈ 3min Views:
Summary
A comprehensive guide to DNS over HTTPS (DoH), how it improves privacy in Bangladesh, and how to enable it.

DNS over HTTPS (DoH) Explained

Direct Answer

DNS over HTTPS (DoH) is a security protocol that encrypts your DNS queries by sending them over a standard HTTPS connection. This prevents third parties, including your Internet Service Provider (ISP), from seeing, tracking, or altering the websites you attempt to visit.

Overview

Traditional DNS queries are sent in “plain text” over port 53. This means anyone sitting between your computer and the DNS server—such as your ISP or a hacker on a public Wi-Fi—can see every domain you look up. DoH solves this by wrapping the DNS request inside an encrypted HTTPS packet. By using port 443 (the standard port for secure web traffic), DoH traffic is indistinguishable from regular web browsing, making it extremely difficult to block or hijack.

Technical Deep-Dive

DoH operates at the Application Layer (Layer 7) of the OSI model.

  • The Process: When you type a URL, your browser sends an encrypted DNS request to a DoH-compatible resolver (like Cloudflare’s 1.1.1.1 or Google’s 8.8.8.8) using a secure TLS tunnel.
  • Encryption: Typically uses TLS 1.2 or 1.3 to ensure the integrity and privacy of the data.
  • Privacy Benefits: It prevents “DNS Spoofing” and “Man-in-the-Middle” (MitM) attacks where a malicious actor redirects you to a fake version of a website.

Bangladesh Context

In Bangladesh, DoH is a vital tool for privacy-conscious users due to local networking practices:

  1. DNS Hijacking: Many local ISPs in Bangladesh intercept plain-text DNS queries on port 53. They redirect these queries to their own local cache servers to optimize BDIX routing or to enforce regulatory blocks. DoH bypasses this interception because the ISP cannot “see” inside the encrypted HTTPS packet.
  2. Regulatory Filtering: While DoH can bypass simple DNS-based blocks, it is not a complete “unblocker.” Regulatory bodies in Bangladesh often use SNI (Server Name Indication) filtering or IP-based blocking at the IIG level, which can still detect the destination even if the DNS query itself was encrypted.
  3. Local Speed: Using a global DoH provider like Cloudflare might slightly increase your initial “first-click” latency compared to an unencrypted local ISP DNS, but it ensures a more stable and private connection.

How to Enable DoH

  • Chrome: Settings > Privacy and security > Security > Use secure DNS.
  • Firefox: Settings > Privacy & Security > DNS over HTTPS (Max Protection).
  • Edge: Settings > Privacy, search, and services > Security > Use secure DNS.

Troubleshooting

  • “Connection Refused”: Some corporate or restricted networks block known DoH resolver IPs.
  • Captive Portals: If you are at a hotel or airport Wi-Fi, you may need to disable DoH temporarily to see the “Sign-in” page.

FAQ

Does DoH hide my entire browsing history from my ISP?

No. While it hides the name of the site you are looking up, the ISP can still see the IP address of the server you are connecting to. For total privacy, you would need a VPN.

Related Content

References