DoH

What DoH Is Used for

DNS over HTTPS wraps DNS lookups inside normal HTTPS sessions, which means the query content is encrypted in transit and less obvious to intermediaries that would otherwise inspect plain DNS. That privacy gain is the core reason it exists, but it also changes how security teams observe name resolution.

In practice, DoH is both a transport choice and a visibility choice. The DNS function still happens, but it now rides over an application protocol that many networks already allow by default, so defenders may see the web connection while losing the individual DNS query trail.

Why DoH Changes Defender Visibility

Traditional DNS is easy to log, filter, and correlate because the resolver traffic is often separated from ordinary web browsing. With DoH, that separation shrinks, which can limit detection of unusual domain lookups, malware beaconing, and infrastructure discovery. NIST Cybersecurity Framework 2.0 is useful here because the term sits at the intersection of visibility, monitoring, and response.

For defenders, the practical issue is not encryption itself, it is that encrypted name resolution can remove a low-friction telemetry source. That matters when investigators need to distinguish benign browsing from suspicious resolution patterns, especially during early-stage compromise.

How DoH Is Abused in Threat Activity

Threat actors can use DoH to blend malicious resolution into ordinary HTTPS traffic or to reduce the chance that a network appliance will flag a suspicious domain lookup. That makes the technique attractive for command-and-control lookups, staging, and other low-noise activity that benefits from hiding in common web traffic.

The abuse pattern is straightforward: if the network only watches for visible DNS sessions, adversaries may move name resolution to an encrypted channel and rely on the defender’s trust in HTTPS. MITRE ATT&CK Enterprise Matrix is the best-fit external reference for mapping that behaviour to adversary technique and detection logic.

What Security Teams Should Understand About DoH

DoH is not inherently malicious, and blocking it outright can create privacy and usability trade-offs. The better question is where resolver policy belongs, which clients are permitted to use external resolvers, and how telemetry will be recovered if DNS visibility is reduced. NIST AI Risk Management Framework is not a direct DoH standard, but it illustrates the broader principle that control decisions should be tied to the observed risk, not the protocol label alone.

In mature environments, DoH handling usually becomes a policy and monitoring decision rather than a simple allow-or-block choice. The important operational question is whether encrypted resolution is being used intentionally for privacy, or opportunistically to conceal activity that defenders need to see.

Risk and Threat Considerations

DoH creates a real visibility risk when organisations depend on DNS logs for detection, filtering, or incident reconstruction. The main concern is that a benign privacy feature can also remove a useful security control point, especially if clients are free to use external resolvers without governance.

Failure mechanism: DNS lookups move into encrypted HTTPS sessions, so network controls that expect cleartext DNS lose inspection and correlation opportunities.

Impact: Malicious domains, beaconing, or resolver abuse can blend into normal web traffic, making detection slower and investigations less complete.

Practitioner Guidance

Why practitioners should care: DoH forces a decision about where name-resolution visibility will live, because “secure transport” and “security monitoring” are not the same thing. Teams should align resolver policy with logging, threat detection, and acceptable privacy posture rather than assuming the browser or endpoint default is sufficient.

What to watch for: Pay attention to unmanaged clients, shadow resolver use, and sudden loss of DNS telemetry from systems that previously emitted it. Those are often the first signs that encrypted resolution is bypassing existing security assumptions.

Related resources from NHI Mgmt Group

• What is the difference between DoH and DoT for enterprise DNS policy?
• Doh And Dot