RFC 8484 / START HERE
DNS over HTTPS, before the details
DoH: DNS over HTTPS
DoH carries Domain Name System messages using HTTPS requests and responses. It combines DNS lookup messages with the web's encrypted request transport.
The idea in one picture
An app builds a DNS query
HTTPS carries it to a resolver
A DNS answer comes back
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
Applications need a defined way to send DNS through HTTPS infrastructure while preserving DNS message semantics.
A familiar example
A browser asks its configured DoH resolver for a domain's address using an HTTPS request.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Choose the HTTPS resolver endpointA DoH client uses a configured URI template for its chosen resolver.→
- Send DNS using GET or POSTGET encodes a DNS wire message in a base64url query variable; POST carries the binary message in the body.→
- Read HTTP and DNS errors separatelyHTTP status describes the HTTP exchange; DNS RCODE describes the embedded DNS result.→
- Respect DNS TTL and HTTP cache ageHTTP caching must not extend the underlying DNS data’s usable lifetime.→
- Understand who can still observe queriesHTTPS hides content from some network observers while the DoH service still receives the DNS question.→
This introduction explains RFC 8484 (2018). Read the original RFC ↗