Can encrypting your web traffic actually make the internet less secure for everyone?
In short: DNS over HTTPS aims to protect your privacy by encrypting the requests that translate website names into IP addresses. While this stops eavesdropping, it also blinds security tools that monitor for malicious activity. As browsers adopt this standard, a complex debate rages over who should control your network traffic.
Domain Name System (DNS) is the internet's phonebook, traditionally operating in plain text. DNS over HTTPS (DoH) upgrades this by wrapping queries in the same encrypted HTTPS protocol used for secure web browsing. By standardizing this via RFC 8484 in October 2018, the IETF sought to prevent man-in-the-middle attacks and data manipulation. Major browsers like Firefox and Chrome have since integrated DoH, often defaulting to specific providers like Cloudflare or Google to handle these encrypted lookups.
However, this privacy gain creates a significant security blind spot. Because DoH traffic is encrypted, traditional network-level filters—used by parents to block content or by enterprises to detect malware—can no longer inspect the queries. The 2019 Godlua worm famously exploited this to hide its command-and-control communications. In January 2021, the NSA advised enterprises to block external DoH resolvers entirely, recommending that organizations manage their own internal DoH infrastructure to maintain visibility and audit capabilities.
The tension reached a peak in 2019 when the British Internet Service Providers Association (ISPA) nominated Mozilla for an 'Internet Villain' award, claiming Firefox's DoH implementation would bypass mandatory UK web-blocking and parental controls. Mozilla pushed back, arguing the technology improves infrastructure security, eventually leading to an ISPA apology and a pause on default DoH deployment in the UK. The IETF's Adaptive DNS Discovery working group continues to navigate these competing interests, seeking a consensus on how to balance user privacy with the operational needs of network administrators.
Experimental extensions like Oblivious DNS over HTTPS (ODoH), published as RFC 9230 in June 2022, attempt to further improve privacy by decoupling the client's IP address from their specific query. By routing requests through a proxy, ODoH ensures that no single server knows both who is asking and what they are looking for, representing the next frontier in the ongoing evolution of internet privacy standards.
Opens the Intellect+ feed with this card first. Swipe up for the next one.
Sources
- Summary by Intellect · source: DNS over HTTPS
To cite this card, link to https://intellectplus.co.uk/app/culture-dns-over-https.
How we source, check and correct cards: Editorial standards.
General information, not professional advice. Spotted an error? Flag the card or see corrections and complaints.
Intellect Plus is a visual educational discovery platform for exploring fascinating facts and ideas. Brain Food, Not Brain Rot. What is Intellect Plus?
Related
More in Languages · More in Cultures · Latest · A–Z · All topics
