DNS over HTTPS Explained: Privacy, SOC Blind Spots & Enterprise Policy (Animated)

Classic DNS is unencrypted, so anyone on the path can see and alter it. DNS over HTTPS (DoH) hides DNS inside normal HTTPS traffic. Great for privacy, but it also lets software bypass the company DNS server, which is one of the SOC’s best sources of visibility.

1. Classic dns: visible to the company dns server

Normally the laptop asks the company DNS server. It can block known-bad domains and log every lookup for the SOC.

1. DNS QUERY (Office laptop → Company DNS): A normal lookup.
2. DNS ANSWER (Company DNS → Office laptop): Answered, checked against block lists, and logged.

Wireshark filter:

dns

2. Dns over https: the query hides inside https

With DoH the browser sends the DNS question as an HTTPS request straight to a DoH provider. To the network it looks like any other encrypted web traffic on port 443.

1. HTTPS POST (Office laptop → Public DoH provider): Private from anyone on the path, including café Wi-Fi.
2. HTTPS 200 (Public DoH provider → Office laptop): The company DNS server never sees this lookup.

Wireshark filter:

tls.handshake.extensions_server_name contains "dns"

3. Malware using doh: attack: hiding command-and-control lookups

Malware on a laptop resolves its command-and-control (C2) domain through a public DoH provider. The company DNS filter never sees the domain, so it can’t block it, and the SOC has no DNS log to investigate.

1. HTTPS POST (Office laptop → Public DoH provider): The malicious domain lookup is invisible to company controls.
2. HTTPS (Office laptop → Malware C2 server): The malware reaches its controller, and the usual DNS-based alert never fires.

What the soc looks for:

HTTPS to known DoH providers from non-browser processes

4. Keep dns visible: defence: one approved resolver

Set enterprise policy so devices use the company resolver (which can itself use encrypted DNS upstream), disable DoH in managed browsers, block known public DoH endpoints at the firewall, and alert on DoH from unexpected processes.

1. HTTPS POST (Office laptop → Public DoH provider): The firewall drops the DoH connection.
2. DNS QUERY (Office laptop → Company DNS): Forced back to the company resolver, the lookup is blocked and the SOC is alerted.

Enterprise policy:

Browsers: DnsOverHttpsMode = off (managed)
Answer NXDOMAIN for use-application-dns.net
Firewall: block known DoH provider IPs

FAQ