What Is DNS Over HTTPS (DoH)?

Why It Matters

Traditional DNS queries are sent in plain text over UDP. Anyone on the network path — your ISP, a coffee shop Wi-Fi operator, or an attacker — can see which domains you’re visiting. DNS over HTTPS wraps these queries in encrypted HTTPS connections.

For domain forwarding, DoH is transparent. It encrypts the DNS lookup that finds Domain Forward’s servers, and then the redirect itself is handled over HTTPS — so the entire chain from DNS query to redirect is encrypted.

How It Works

Traditional DNS:

Browser → DNS query (plain text, UDP port 53) → Resolver → Response

Anyone on the network can read: “This user is looking up example.com”

DNS over HTTPS:

Browser → HTTPS POST to resolver (encrypted, port 443) → Response

Network observers see encrypted HTTPS traffic to the resolver — they can’t read the domain being queried.

DoH vs Traditional DNS vs DNSSEC

Feature	Traditional DNS	DoH	DNSSEC
Encrypted	No	Yes	No
Authenticated	No	TLS cert	Yes
Privacy	None	High	None
Prevents tampering	No	Yes (TLS)	Yes (signatures)

How Domain Forward Relates

Domain Forward’s redirect chain benefits from DoH when visitors use DoH-enabled browsers:

1. DNS query — encrypted via DoH (if browser supports it)
2. Certificate provisioning — automatic SSL/TLS for your domain
3. Redirect — served over HTTPS with a 301 status code

All three steps can be fully encrypted, providing end-to-end privacy.