What does DoH stand for?
DoH stands for DNS over Hypertext Transfer Protocol Secure. DNS queries carried inside HTTPS on TCP 443, so they are encrypted and blend in with web traffic. It protects user privacy but can bypass an organization's DNS filtering and logging, which is why many enterprises block or control it.
DoH sends DNS queries inside an ordinary HTTPS connection, on TCP port 443, instead of as clear text on port 53. Anyone between the device and the resolver, such as the operator of a public Wi-Fi network, can no longer read or alter which names are being looked up. Because it looks like any other HTTPS traffic, it is hard to single out and block. That cuts both ways. It protects users' privacy, and it also lets a browser or a piece of malware bypass the organization's own DNS filtering and logging unless DoH is managed, for example by pointing clients at an approved resolver.
DoH in practice: an example
A school filters websites by answering DNS queries for blocked categories with a block page. A student's browser is set to use a public DoH resolver, so its lookups travel inside HTTPS to that resolver and the school's DNS servers never see them. The administrators respond by configuring the managed browsers to use the school's own resolver and by blocking known public DoH servers at the firewall.
What DoH is confused with
DoH vs DoT: what is the difference?
DNS over TLS also encrypts DNS, but on a port of its own, TCP 853, so it is easy to identify and to allow or block. DoH hides inside port 443 with all other web traffic.
DoH vs DNSSEC: what is the difference?
DNSSEC signs DNS records so that a resolver can check that they are authentic. It hides nothing. DoH encrypts the conversation between client and resolver and does not prove that the records are genuine. They solve different problems and work together. What DNSSEC stands for
Which exams cover DoH?
DoH is on the official CompTIA acronym list for one of the four exams covered here.
- Network+ N10-009: 3.0 (Network Operations).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. Which port does DNS over HTTPS use?
- TCP 443
- UDP 53
- TCP 853
- UDP 123
Show the answer
A. TCP 443. DoH is DNS carried in HTTPS, so it uses 443. Classic DNS uses 53 and DNS over TLS uses 853.
2. Why can DoH be a concern for an organization that filters and logs DNS?
- Clients can send lookups to an outside resolver inside HTTPS, bypassing the internal DNS servers
- It disables TLS on the web servers
- It doubles the size of every DNS zone
- It requires IPv6 on all switches
Show the answer
A. Clients can send lookups to an outside resolver inside HTTPS, bypassing the internal DNS servers. Encrypted lookups to an external resolver are invisible to controls that depend on seeing DNS. The answer is to manage DoH: approve a resolver and block the others.
Sources: RFC 8484: DNS Queries over HTTPS (DoH); RFC 7858: Specification for DNS over Transport Layer Security (TLS); Microsoft Learn: Secure DNS Client over HTTPS (DoH). The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 12 November 2026.