DNS over HTTPS (DoH) encrypts the lookups that turn a site name into an IP address. On plain DNS, those lookups often travel in the clear to your ISP’s resolver. With DoH, the same kind of query rides inside HTTPS to a resolver you (or your browser) chose.
That is the useful change. It is not a VPN. It does not hide your public IP. Websites still see whatever address your path presents — check it anytime on the homepage.
This post is for everyday users: what DoH changes, what it leaves alone, when it helps, and where people get confused.
Plain DNS in one minute
When you type example.com, your device asks a DNS resolver which IP to use. On many home and mobile setups, that resolver is your ISP’s. The query names the host you want. On classic DNS, anyone who can see that traffic on the path — including the resolver operator — can read those names.
Your browser then connects to the IP it got. HTTPS may encrypt the page itself. The name lookup can still have been visible earlier. DoH targets that lookup step, not the whole browsing session.
How caches and timing work is a separate topic: what DNS propagation means. Decoding record types is another: how to read DNS lookup results.
What DoH changes
1. The lookup is encrypted on the wire. A café Wi‑Fi eavesdropper who only watches open DNS packets has a harder time reading which hostnames you asked for. The DoH session looks like other HTTPS traffic to the resolver’s host.
2. Who runs your resolver can change. Browsers and OSes may send DoH to a third-party resolver instead of the ISP’s default. That moves the list of queried names from “whoever runs DHCP DNS on this network” to “whoever runs that DoH service.” Trust moves; it does not disappear.
3. Local network filters that only watch plain DNS may miss those queries. Parental controls, some school filters, and simple router “block lists” often assume classic DNS on port 53. DoH can bypass that path. That is a feature for privacy on hostile Wi‑Fi and a headache for admins who relied on old DNS filtering.
4. Your public IP for websites usually stays the same. DoH encrypts name lookups. It does not replace your ISP path the way a VPN exit does. After you turn DoH on, reload What Is My IP. Expect the same address as before unless something else (VPN, network switch) also changed. For the provider label on that address, use ISP Lookup.
What DoH does not hide
Destinations still see your IP. The server you visit logs a source address. DoH never swaps that label. For what that label can imply, see what your IP address reveals.
HTTPS sites still know the hostname you requested (via SNI and certificates in typical setups). Encrypting DNS does not make every site visit anonymous.
Accounts and cookies still identify you. Logging into email or social apps ties activity to you regardless of how DNS ran.
Your ISP still sees a customer session. They may see less of the names you looked up if those queries leave via DoH to someone else. They still see volume, timing, and IPs you connect to. Broader ISP visibility: what your ISP can still know.
A VPN is a different tool. A working VPN usually changes the visible public IP for tunneled traffic. DoH does not. Compare them in what a VPN changes on your IP — DoH is about the resolver path; a VPN is about the exit identity.
When DoH helps (and when it barely matters)
Helpful when:
- You use untrusted Wi‑Fi and want fewer cleartext DNS names on the local network.
- You prefer a resolver with a published logging policy over the network’s default.
- You want browser-level consistency: same encrypted DNS habit across hotels and home.
Barely matters when:
- You already route everything through a VPN that also sets DNS inside the tunnel — DoH on top may be redundant or conflicting.
- Your threat model is “hide from the sites I log into.” DNS encryption does not log you out or mask accounts.
- You only needed a different public IP. Use a VPN (and verify on the homepage), not DoH alone.
Common pitfalls
“I enabled DoH so I am invisible.”
False. Your public IP, logins, and most destination metadata remain. DoH shrinks one window: cleartext name lookups to the default resolver path.
“DoH and VPN are the same.”
No. VPN → often new exit IP. DoH → encrypted lookups, usually same IP. Check both claims separately.
“My filter stopped working; the internet is broken.”
Some networks block or break third-party DoH on purpose. Others still allow it and then wonder why DNS-based blocks fail. If a site fails only with DoH on, try the network default once to isolate the cause — then decide which policy you want, rather than toggling forever.
“All apps use my browser’s DoH.”
Not always. OS settings, other browsers, games, and IoT devices may still use plain DNS from DHCP. Browser DoH covers that browser. System-wide encrypted DNS is a different switch.
“FindMyIP’s DNS tool proves my DoH is on.”
No. DNS Lookup asks this site’s server resolver about a domain’s public records. It does not show which resolver your browser used. To confirm DoH, use your browser or OS encrypted-DNS status, not a public record lookup.
“Any DoH provider is fine.”
You trade ISP visibility of query names for that provider’s visibility. Read their logging and jurisdiction notes. There is no affiliate pitch here — pick based on policy you accept, not slogans.
A short practical check
- Note your public IP on the homepage with DoH off (or default).
- Enable DoH in the browser or OS using a resolver you chose on purpose.
- Reload the homepage. The IP should usually match. If it changed, something else moved (VPN, network).
- Optional: run ISP Lookup — expect the same home/carrier org unless a VPN is involved.
- Visit a site that previously failed only under network DNS filters; notice whether behavior changed. That is a signal about filtering vs privacy, not a bug by itself.
Bottom line
DoH encrypts DNS lookups and can move them off your ISP’s plain resolver. It does not hide your public IP, replace a VPN, or anonymize logged-in browsing. Use it when cleartext DNS on the local path or default resolver trust is the concern. Verify your visible address on What Is My IP, keep VPN expectations separate, and treat resolver choice as a trust decision — not a magic privacy switch.