# Can DNS over HTTPS hide traffic from security monitoring?

It can hide the DNS lookups, not the connections that follow. DNS over HTTPS (DoH, RFC 8484) and DNS over TLS (DoT, RFC 7858) encrypt the questions a device asks its resolver. If browsers or apps use an outside DoH resolver, your company DNS server and its logs no longer see which names they look up, which weakens DNS-based filtering and investigations. Malware can use DoH for the same reason. The connections to the actual destinations still cross the network with their IP addresses, timing and volume, and often with the server name in the TLS handshake. Practical steps: run your own resolver, or use a provider's, that supports encrypted DNS, and point managed devices at it; use browser and operating-system policies to stop them using other resolvers; and look for devices that talk to public DoH services directly. DoT is easy to spot because it uses port 853; DoH looks like ordinary HTTPS. NetSenX alerts on DNS tunnelling; it does not filter or block DNS.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/can-dns-over-https-hide-traffic-from-security-monitoring

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [How do I decrypt TLS traffic for troubleshooting?](https://netsenx.com/en/faq/how-to-decrypt-tls-for-troubleshooting)
- [How does a TLS handshake work?](https://netsenx.com/en/faq/how-does-a-tls-handshake-work)
- [What changed between TLS 1.2 and TLS 1.3?](https://netsenx.com/en/faq/what-changed-between-tls-1-2-and-tls-1-3)
- [Should we disable TLS 1.0 and 1.1?](https://netsenx.com/en/faq/should-we-disable-tls-1-0-and-1-1)
- [Which TLS ciphers should we turn off?](https://netsenx.com/en/faq/which-tls-ciphers-should-we-turn-off)