Encrypted Conflicts The Disruptive Impact of DNS over HTTPS on Domain Filtering Regimes

The advent of DNS over HTTPS (DoH) has triggered a seismic shift in the landscape of internet infrastructure, particularly in how domain name queries are resolved and monitored. While the primary goal of DoH is to enhance privacy and security by encrypting DNS traffic—thus preventing eavesdropping and manipulation by third parties—it has also undermined longstanding systems of network-based content filtering and control. For governments, educational institutions, ISPs, and enterprises that rely on DNS-based filtering to block access to harmful or prohibited content, DoH represents not just a technological evolution but a governance challenge. The fallout from this innovation is not merely technical but also legal, political, and deeply cultural, as it tests the boundaries of control in an increasingly encrypted internet.

Traditional DNS queries are transmitted in plaintext over port 53, meaning that any intermediary with access to the user’s network—be it an ISP, employer, or state agency—can see, log, or redirect those requests. This transparency has allowed DNS to be used not only for name resolution but also as a mechanism for filtering. Network administrators have long deployed DNS filters to block domains associated with malware, pornography, hate speech, gambling, or unlicensed streaming services. These filtering regimes are especially prevalent in schools, corporate networks, and countries with strong internet censorship laws. Whether implemented for security, policy enforcement, or ideological reasons, DNS filtering has been a staple tool for exercising control over user access.

DNS over HTTPS disrupts this model by encrypting the DNS queries within HTTPS traffic—typically over port 443—rendering them indistinguishable from ordinary web traffic. Instead of being sent to a local resolver controlled by the ISP or institution, DoH queries are often directed to remote resolvers operated by companies like Cloudflare, Google, or NextDNS. These resolvers are generally outside the administrative domain of local network operators and are bound by different jurisdictional and policy constraints. As a result, local DNS filters become ineffective, as they are simply bypassed. The domain queries are no longer visible or interceptable by traditional means, effectively neutering the ability of the local network to enforce filtering policies.

The consequences have been immediate and wide-ranging. In authoritarian countries that maintain strict control over information flows—such as China, Iran, or Russia—DoH has been flagged as a threat to national censorship regimes. Some of these states have responded with aggressive countermeasures, including blocking access to known DoH resolvers or mandating the use of state-controlled DNS servers. Russia’s telecommunications regulator, Roskomnadzor, has periodically blocked DoH endpoints or issued directives requiring ISPs to inspect and filter encrypted DNS traffic. China, with its sophisticated Great Firewall, has sought to detect and throttle DoH usage through deep packet inspection and protocol fingerprinting. These efforts highlight how DoH, while designed to enhance individual privacy, can provoke state backlash and spur further innovation in network surveillance.

In liberal democracies, the conflict is more nuanced but no less significant. Public schools and corporate offices that previously relied on DNS filters to enforce acceptable use policies now find their systems circumvented by browsers and devices that default to DoH. When Mozilla enabled DoH by default in Firefox for U.S. users in 2020, it ignited protests from network operators who feared it would disable enterprise-level filtering and logging. Similar concerns were raised when Google integrated DoH functionality into Chrome, prompting debates over whether browser vendors were usurping the role of local network administrators. While both companies allowed opt-out mechanisms for managed environments, the broader shift toward encrypted DNS remains a challenge for institutions that depend on DNS-level visibility to manage risk, ensure compliance, or protect minors.

This has led to a rethinking of filtering architectures. Some organizations have attempted to block access to DoH endpoints via firewalls or proxy filtering, essentially playing a game of digital whack-a-mole. Others have pivoted to DNS over TLS (DoT), a similar encryption protocol that offers more flexibility for managed networks but still faces discoverability issues. There is also a growing trend toward endpoint filtering—using agents installed on user devices to inspect and block domains before they are resolved, regardless of the transport layer. However, such solutions are more complex to deploy and manage, especially in bring-your-own-device (BYOD) environments or among mobile workforces.

From a legal perspective, the shift to DoH complicates regulatory oversight. Laws that require ISPs to block access to specific domains, such as the U.K.’s Online Safety Bill or various national anti-piracy regimes, often rely on DNS manipulation as a compliance mechanism. When DNS traffic is encrypted and routed to out-of-jurisdiction resolvers, these enforcement mechanisms become ineffective. This has sparked calls for legislative updates to address encrypted DNS and to mandate data retention or filtering at other layers of the network stack. Yet such proposals are fraught with privacy concerns and technical limitations. Mandating backdoors in encrypted DNS would not only contradict privacy principles but also likely prove unworkable in a globally distributed network.

DoH also complicates the task of cyber threat intelligence and incident response. Security teams often rely on DNS logs to identify command-and-control domains, monitor lateral movement, or detect data exfiltration attempts. When DNS queries are encrypted and offloaded to third-party resolvers, this telemetry disappears. Some DoH providers offer APIs or logging features for enterprise use, but this introduces new concerns about data centralization, third-party trust, and jurisdictional control. Enterprises must now weigh the trade-offs between privacy, security, and visibility in designing their network architecture.

Despite the turbulence it causes, DNS over HTTPS also delivers tangible benefits. It thwarts man-in-the-middle attacks, prevents ISP-level tracking, and protects users in hostile or surveillance-heavy environments. For activists, journalists, and individuals in repressive regimes, encrypted DNS is a lifeline to uncensored information. It restores a measure of confidentiality to an essential but previously transparent component of internet activity. In this sense, DoH embodies a wider trend toward encryption-by-default—a trend that aligns with modern conceptions of digital rights and user agency, even as it disrupts legacy models of governance and control.

Ultimately, the fallout from DNS over HTTPS reveals a deeper struggle over who controls the infrastructure of the internet: network operators, browser vendors, governments, or end users. As the balance shifts toward user-centric design and away from network-based control, long-standing assumptions about domain filtering, compliance, and sovereignty are being upended. The challenge for policymakers, technologists, and institutions is to adapt filtering strategies and governance models to a world where DNS is no longer visible by default. Whether this leads to more resilient, rights-respecting systems or to escalating conflicts between privacy and policy will depend on how these competing interests are negotiated in the years to come.

The advent of DNS over HTTPS (DoH) has triggered a seismic shift in the landscape of internet infrastructure, particularly in how domain name queries are resolved and monitored. While the primary goal of DoH is to enhance privacy and security by encrypting DNS traffic—thus preventing eavesdropping and manipulation by third parties—it has also undermined longstanding…