DNS-over-HTTPS, or DoH, is a way to send DNS queries and responses inside HTTPS traffic. Instead of using plain DNS on port 53, the resolver wraps the DNS message in a normal-looking web request. This protects DNS content from passive network observers and makes it harder to tamper with in transit.
DoH matters because it changes both privacy and security controls. It can reduce local DNS visibility for defenders, but it also creates a new parsing boundary: the server must handle HTTP, TLS, and the DNS payload correctly. Attackers may target that boundary with malformed requests to cause denial of service or, in worse cases, memory-safety bugs. Defenses include patching resolvers, limiting who can reach DoH endpoints, monitoring for abnormal request patterns, and treating DoH as a distinct service that needs its own access control and logging.