Can malware hide in DNS over HTTPS, and can we still see it?
It can, and visibility drops. DNS over HTTPS (DoH) sends name lookups inside ordinary encrypted web traffic to a resolver, often a public one, so your own DNS server and its logs never see them. Browsers and some operating systems can switch it on by themselves, and malware can use it to hide both its lookups and tunnelled data. What you can still do: configure browsers and devices by policy to use your own resolver, block known public DoH resolvers at the firewall where that suits your environment, and look into any device that sends steady encrypted traffic to a DoH resolver while ignoring your DNS server. A network sensor sees the connection to the resolver, its timing and volume, but not the names inside. NetSenX never decrypts traffic, so it cannot read DoH lookups; it can still flag the beaconing pattern.