Can DNS over HTTPS hide traffic from security monitoring?

It can hide the DNS lookups, not the connections that follow. DNS over HTTPS (DoH, RFC 8484) and DNS over TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. (DoT, RFC 7858) encrypt the questions a device asks its resolver. If browsers or apps use an outside DoH resolver, your company DNS server and its logs no longer see which names they look up, which weakens DNS-based filtering and investigations. Malware can use DoH for the same reason. The connections to the actual destinations still cross the network with their IP addresses, timing and volume, and often with the server name in the TLS handshake. Practical steps: run your own resolver, or use a provider's, that supports encrypted DNS, and point managed devices at it; use browser and operating-system policies to stop them using other resolvers; and look for devices that talk to public DoH services directly. DoT is easy to spot because it uses port 853; DoH looks like ordinary HTTPS. NetSenX alerts on DNS tunnelling; it does not filter or block DNS.

← All 40 questions on Encryption and encrypted trafficAll topics