# Can malware hide in DNS over HTTPS, and can we still see it?

It can, and visibility drops. DNS over HTTPS (DoH) sends name lookups inside ordinary encrypted web traffic to a resolver, often a public one, so your own DNS server and its logs never see them. Browsers and some operating systems can switch it on by themselves, and malware can use it to hide both its lookups and tunnelled data. What you can still do: configure browsers and devices by policy to use your own resolver, block known public DoH resolvers at the firewall where that suits your environment, and look into any device that sends steady encrypted traffic to a DoH resolver while ignoring your DNS server. A network sensor sees the connection to the resolver, its timing and volume, but not the names inside. NetSenX never decrypts traffic, so it cannot read DoH lookups; it can still flag the beaconing pattern.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/can-malware-hide-in-dns-over-https

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is low-and-slow data exfiltration, and how is it detected?](https://netsenx.com/en/faq/what-is-low-and-slow-data-exfiltration)
- [Why do simple bandwidth alarms miss data theft?](https://netsenx.com/en/faq/why-do-bandwidth-alarms-miss-data-theft)
- [What does Cobalt Strike activity look like on the network?](https://netsenx.com/en/faq/what-does-cobalt-strike-look-like-on-the-network)
- [Is internal port scanning a sign of an intruder?](https://netsenx.com/en/faq/is-internal-port-scanning-a-sign-of-an-intruder)
- [How do we know if someone is guessing passwords on our internal network?](https://netsenx.com/en/faq/how-to-know-if-someone-is-guessing-passwords-internally)