DNS-over-HTTPS, usually shortened to DoH, is a privacy and security feature that encrypts DNS queries by sending them over HTTPS. A DoH test helps you confirm whether your browser, device, or network is actually using encrypted DNS instead of traditional plain-text DNS. This matters because DNS requests can reveal which websites you visit, even when the websites themselves use HTTPS.
TLDR: To check DNS-over-HTTPS, use a reputable browser-based test page, verify your browser’s secure DNS settings, and compare results with a DNS leak test. If DoH is enabled, your DNS resolver should appear as a provider that supports encrypted DNS, such as Cloudflare, Google, Quad9, or your configured private resolver. For a reliable result, test in the exact browser, app, and network you normally use.
Contents
What a DoH Test Actually Checks
A DoH test checks whether your DNS queries are being sent through an encrypted HTTPS connection rather than through conventional DNS on port 53. Traditional DNS is usually unencrypted, meaning your internet service provider, public Wi-Fi operator, employer, or other network observer may be able to see domain lookups.
DoH does not hide the fact that you are using the internet, and it does not replace a VPN. It also does not make unsafe websites safe. Its main purpose is to reduce DNS-level surveillance, tampering, and interception by encrypting the request between your device or browser and the DNS resolver.
Method 1: Use a Browser-Based DoH Test
The simplest way to check DNS-over-HTTPS is to use a browser-based diagnostic page provided by a trusted DNS provider or security organization. These pages usually detect which resolver answered your DNS request and whether that resolver is known to support encrypted DNS.
Common testing pages include provider diagnostics from major DNS services such as Cloudflare or similar resolver operators. When you run the test, look for results such as “Using DNS-over-HTTPS”, “Secure DNS enabled”, or “Encrypted DNS detected.”
For best accuracy, follow these steps:
- Open the browser you actually use. DoH may be enabled in one browser but not another.
- Disable VPNs temporarily if you want to test the browser’s own DNS behavior.
- Run the test on your regular network, such as home Wi-Fi, office LAN, or mobile hotspot.
- Repeat the test in private or incognito mode if extensions or profiles may affect DNS behavior.
If the result says DoH is not enabled, it does not always mean your device is insecure. It may mean your operating system, router, VPN, or corporate security tool is handling DNS differently.
Method 2: Check Secure DNS Settings in Your Browser
Most modern browsers include a setting called Secure DNS, DNS-over-HTTPS, or something similar. Checking this setting helps you confirm whether DoH is intentionally enabled rather than merely appearing in a test result.
In many Chromium-based browsers, you can usually find it under:
- Settings
- Privacy and security
- Security
- Use secure DNS
You may be able to choose between using your current service provider, if it supports DoH, or selecting a custom provider. Well-known options often include Cloudflare, Google Public DNS, OpenDNS, or Quad9, depending on the browser and region.
In Firefox, DoH settings are typically found under Privacy & Security, often in a section related to DNS or network settings. Firefox may allow several modes, including default protection, increased protection, or custom resolver configuration.
Method 3: Run a DNS Leak Test
A DNS leak test shows which DNS resolvers are being used when your device looks up domain names. This is especially useful if you use a VPN, proxy, corporate endpoint tool, or custom DNS service.
To run a basic DNS leak check:
- Connect to the network you want to test.
- Open your normal browser.
- Visit a reputable DNS leak testing website.
- Run the standard or extended test.
- Review the listed DNS servers and provider names.
If you expect to use a specific DoH provider, the test should show DNS servers associated with that provider. If it shows your internet service provider instead, your setup may not be using DoH as expected, or another network component may be overriding DNS.
Be careful when interpreting results. A DNS leak test can show who handles your DNS, but it may not always prove how the DNS request was transported. For example, it may identify Cloudflare as your resolver, but you may still need a dedicated DoH test or browser diagnostics to confirm encryption.
Method 4: Use Browser Diagnostic Pages
Some browsers provide internal diagnostic pages that show network and DNS behavior. These pages are more technical, but they can be useful when ordinary test websites give unclear results.
For example, browser network diagnostics may show whether DNS queries are resolved through HTTPS, whether a resolver is being upgraded automatically, and whether there are errors. This is particularly helpful for troubleshooting enterprise networks, managed devices, or custom resolver configurations.
If you are not comfortable interpreting technical logs, focus on the browser’s Secure DNS settings and a trusted external test page. Those two checks are usually sufficient for everyday users.
Common Reasons a DoH Test Fails
If your DoH test shows that DNS-over-HTTPS is not active, several explanations are possible:
- Secure DNS is disabled in the browser settings.
- Your selected DNS provider does not support DoH or is unavailable.
- A VPN is controlling DNS and bypassing browser-level settings.
- Enterprise or school policies block DoH for monitoring or compliance purposes.
- Your router or security software intercepts DNS and redirects requests.
- Parental controls or filtering services require traditional DNS handling.
In managed environments, do not bypass security policies without permission. Organizations may disable DoH to enforce malware filtering, logging, or data protection rules.
How to Enable DoH Safely
If your test shows that DoH is off and you want to enable it, use a well-known resolver with a clear privacy policy. Avoid unknown DNS providers, because encrypted DNS still requires trust: the resolver can process the domain names you request.
A sensible setup includes:
- A reputable DNS provider with DoH support.
- Automatic HTTPS upgrades where available.
- Regular testing after browser, VPN, or operating system updates.
- Consistency across devices if you want the same privacy behavior everywhere.
What DoH Does Not Protect
DoH protects DNS queries in transit, but it is not a complete anonymity tool. Websites can still see your IP address unless you use a VPN, proxy, or privacy network. Your browser may still expose information through cookies, account logins, fingerprinting, and tracking scripts.
Also, some domain information may still be visible through other technical signals, depending on the connection and network environment. DoH is one layer of protection, not a complete privacy solution.
Final Checklist for a Reliable DoH Test
- Run a trusted DoH test page in your normal browser.
- Confirm that Secure DNS or DNS-over-HTTPS is enabled.
- Use a DNS leak test to verify the resolver shown.
- Test with and without your VPN if applicable.
- Repeat the test on each browser, device, and network you use.
A proper DoH test is not complicated, but it should be done carefully. By checking both the browser setting and the resolver result, you can confirm whether your DNS traffic is actually encrypted. For most users, enabling DoH through a trusted browser or DNS provider is a practical step toward stronger everyday privacy and better protection against DNS interception.