DNS over HTTPS (DoH)
DNS queries wrapped inside HTTPS on port 443, hiding which domains you visit from the network.
DNS over HTTPS (DoH, RFC 8484) encrypts the DNS query inside a normal HTTPS request and sends it to TCP 443. To a network observer, the traffic looks like any other HTTPS connection — the domain you asked about is hidden inside the encrypted payload. Common public endpoints include Cloudflare (https://cloudflare-dns.com/dns-query), Google (https://dns.google/dns-query), and Quad9. Firefox, Chrome, Edge, and Safari all support DoH natively.
DoH can be configured browser-side (Firefox about:preferences → Network Settings → Enable DNS over HTTPS) or system-side (Windows Settings → Network → DNS, macOS profile, Android 9+ Private DNS). Browser-side only protects that browser; system-side covers all apps but needs a managed profile or third-party client. The two often disagree — if system-level DoH is on, the browser's setting is usually ignored.
To verify DoH is active, run IPCombo's DNS widget: it queries both a DoH endpoint (Cloudflare) and a plain HTTPS endpoint, then compares the response IPs. If they match, DNS is going through the channel you expect. If the plain endpoint shows your ISP's resolver but DoH shows Cloudflare, you have browser-level DoH active but system-level DNS is still leaking.