🔏

DNS over HTTPS (DoH)

Medium

Free preview · 2 of 5 steps

UDP/53 (plaintext)Layer 7 · ApplicationDNS

Query

example.com A

Visible to

ISP, coffee shop WiFi, network admins, governments

UDP/53 (plaintext)Layer 7 · ApplicationDNS

Query

example.com A

Visible to

ISP, coffee shop WiFi, network admins, governments

The privacy problem with traditional DNS

Traditional DNS uses UDP port 53 with no encryption. Your ISP, the coffee shop WiFi operator, and any network device on the path can see every domain you look up — even if the content is HTTPS.

This enables: ISP surveillance and sale of browsing data, targeted censorship (NXDOMAIN injection), and network-level tracking.

UDP/53 (plaintext)DNS

Packet structure

Payload

UDP

DNS

L3

L4

L7

Layer details (click to expand)

7

ApplicationDNS

▼

4

TransportUDP

▼

3

NetworkIPv4

▼

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step