DoH DNS over HTTPS
DNS over HTTPS — DNS queries via TLS-encrypted HTTPS instead of clear-text UDP 53. RFC 8484 (2018). Driven by privacy + security: ISPs can't snoop/manipulate DNS, other-link WiFi can't inject fake responses.
Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9 9.9.9.9 offer DoH endpoints. Firefox enables default since 2020 (USA), opt-in Europe. iOS 14+: per-app DNS config. Controversy: enterprise CIO + schools lose visibility → DoH blocking. Open Resolver list. Distinct from DoT (DNS over TLS, port 853): DoH shares port 443 with HTTPS → hard to firewall-block without blocking all web traffic. ECH (Encrypted Client Hello) + DoH = full TLS handshake privacy.