Your firewall probably blocks known malicious websites, gambling sites or whatever else your policy says. Much of that blocking relies on watching DNS, the Internet’s address book. A browser setting called DNS over HTTPS can send those lookups around your firewall entirely, and most staff would never know it had happened.
That does not make DNS over HTTPS bad. It was designed to protect privacy, and on the right network it does. The problem is DNS over HTTPS that nobody in the business chose or manages.
What DNS is, and what DoH changes
Every time someone visits a website, their computer first asks a DNS server (a directory service) to turn a name like example.com into a numeric address. Traditionally, that question travels unencrypted. Anyone on the path, including your own firewall, can read it.
DNS over HTTPS, usually shortened to DoH, wraps that question in the same encryption used for secure websites. On a coffee-shop Wi-Fi network, that is a real privacy gain. On your office network, it means the firewall that was reading DNS to spot threats may now see only an encrypted connection to some outside server.
Where it comes from
DoH is built into all major browsers and into Windows. The details matter:
- Chrome uses an automatic upgrade: according to the Chromium project, it switches to DoH only if the DNS provider you already use supports it, and managed (business-administered) computers are automatically opted out.
- Firefox turns DoH on by default in some countries and sends lookups to a provider in Mozilla’s program. Mozilla began doing this for U.S. users in February 2020 and in Canada in July 2021. A network can signal it to stand down (more on that below).
- Windows 11 can use DoH at the operating system level, controlled by Group Policy, as Microsoft documents.
- Any user can switch DoH on manually in browser settings and point it at any public provider. So can malware.
The next step: encrypted “hello”
DNS is one of several clues a firewall reads. When a browser opens a secure connection, it has traditionally announced the website’s name in plain text at the start. Encrypted Client Hello (ECH) hides that too. It was published as a standards-track specification, RFC 9849, in March 2026, and Firefox already supports it. As more websites and browsers adopt ECH, filtering that relies on seeing site names will see less. Firefox offers an enterprise policy to switch ECH off on managed computers, and the same principle applies as with DoH: decide centrally, rather than by default.
The business risks of unmanaged DoH
Your filtering stops working
Many security tools block dangerous or inappropriate sites by refusing to answer DNS lookups for them. If a browser sends lookups to an outside DoH server instead, that protection is simply skipped for that browser.
Less visibility into threats
DNS logs are one of the most useful records in an investigation. They show which computers tried to reach which domains, and when. Malware often reveals itself by looking up unusual domain names to contact its operators. Encrypted, off-network DNS removes that trail.
Malware can use it deliberately
Because DoH looks like ordinary secure web traffic, it gives malicious software a convenient way to find its control servers without triggering DNS-based alarms.
Policy becomes optional
If a single browser setting lets any user bypass filtering, your acceptable-use policy becomes a suggestion.
What to do about it
The aim is not to abandon encrypted DNS. It is to make sure encrypted DNS goes to a resolver your business controls, with your security rules applied.
- Set browser policy centrally. Chrome has a DnsOverHttpsMode policy (Edge has an equivalent) that can turn DoH off or point it at a resolver you choose. Firefox also supports enterprise policies for DoH.
- Use Mozilla’s canary domain. Your DNS server can refuse to answer a special name, use-application-dns.net. According to Mozilla, Firefox checks this and turns off default DoH when the lookup fails. It does not override a user who switched DoH on deliberately, so combine it with policy.
- Configure Windows DoH via Group Policy so the operating system uses your approved resolver.
- Block outbound DNS to unapproved servers. At the firewall, allow DNS only to your own resolvers, and block known public DoH providers where your firewall supports it.
- Use a filtering DNS service that supports DoH itself. For example, Sophos DNS Protection is a secure DNS service that includes DNS over HTTPS, applies SophosLabs threat intelligence, and lets administrators block domains individually or by category. That way you get encryption and control together.
- Keep endpoint protection current on every computer, so a device that does slip past DNS filtering still has protection of its own.
- Explain the policy to staff. Most people who enable DoH are trying to protect their privacy. Tell them the office network already encrypts DNS and why the rules exist.
Remote and traveling staff deserve special attention, especially in Alaska, where people often work from lodges, job sites and airports. Settings enforced by policy on the device travel with the laptop; settings that live only on the office firewall do not.
DoH is one of several ways browser traffic can step around business security. We cover a related one, the QUIC protocol, in Google Chrome and your business privacy.
How FTI helps
We secure client networks with Sophos firewall and endpoint protection, and manage browser and Windows settings through our Kaseya-based managed IT services. For DNS, that means approved encrypted resolvers, consistent policy on every device in the office or on the road, and firewall rules that close the side doors.
It also means keeping the DNS and security logs, and reading them. AI watches those logs around the clock alongside our engineers, flagging unusual lookups for a person to check and act on. Read why we chose Sophos for more on our approach.
