A person on my same Wifi network is tracking name of the websites that I visit using tools like Wireshark. Does DNS over HTTPS hide the name of the sites that I visit?

My DNS settings are -

DNS settings1

DNS settings2

If it does not hide the site names, what are the solutions other than VPN to achieve the same? Please ask for clarifications if needed as I don't know much about all this stuff.

3 Answers 3


Yes and no.

DoH will encrypt the communication between you and the DNS server, making it extremely difficult to track through DNS BUT

If your traffic can be sniffed this information is also available - unencrypted - as part of the https negotiation - so for websites it can still be tracked. (only the requested domain - not the full URL.)

Your options for preventing this are limited if you don't use a VPN - you will need an analog - likely a proxy that has encryption or tunnel which effectively do the same thing - wrap your traffic in a second encrypted layer outside the control of people between. Look at SSH tunneling and SOX.

  • 1
    Add to that that DNS only tells your computer where to connect, the fact you asked for www.somesite.com may be hidden, but when it works, and that site is resolved to an IP, your computer then connects to it, and that will be captured. A little sleuthing of reverse IP lookup can turn that right back into a host name most the time. Even if a shared host, it narrows it down significantly. Oct 4 at 18:43
  • @GeneMoody-Action1 Tracking back an IP address can certainly help identify the site - but doesn't provide a 1:1apping - especially for larger properties like stuff behind cloudflare or google/gmail/youtube.
    – davidgo
    Oct 4 at 18:47
  • Correct, but it CAN and very often will divulge information as presented in my actual answer, thus not "Hidden" perfect tracking no, but by no means whatsoever hidden. Oct 4 at 18:55
  • ECH (Encrypted ClientHello) is on the way. In fact Firefox just turned it on by default. But server support is still limited. It uses DNS to pre-distribute keys, so it meshes nicely with DoH.
    – hobbs
    Oct 5 at 2:58


Secure DNS only hides your DNS traffic. So as the name implies it only secures what you do with DNS not what you do with the information you got from DNS.

"Does DNS over HTTPS hide the name of the sites that I visit?" was in question. So what happens if you only employ DNS security,is it prevents data from being openly visible when the you ask for whatever.com to your DNS server which in most home arrangements if off YOUR network..

Your computer then however takes that response of the IP it resolved to and makes a connection. That connection will be in the form of an IP, and IP addresses can be traced back to the site hosted on them (Often). IN the case of multiple sites on the same IP it can be vague, but say for instance one is adult content and the other is crocheting, etc.... Logical deductions can be made.. Now the data to and from that site will almost assuredly be encrypted. So what you did while on the site, will not be known. Nor will what you asked DNS for, but it does nothing to hide what you ultimately connected to.

See image, packet captures WILL show traffic to and from IP addresses. So with secure DNS you would not have seen my computer asked specifically for facebook.com, but you could see the IP it was connected to belonged to facebook enter image description here

  • Actually, with appropriate sniffing you WILL see the domain. Even though https offers encryption, the domain name is requested in the HTTPS negotiation in clear text - this is a limitation of SNI
    – davidgo
    Oct 4 at 19:00
  • True, and because a host header has to be sent to split the traffic once it reaches the IP, good call. Oct 4 at 19:03

Yes, it is just like when you visit a site using HTTPS, nobody sniffing your internet traffic can really see the contents of it, just you and the server. Acording to the RFC8484 Section 8.1 they claim: "DoH encrypts DNS traffic and requires authentication of the server." and that it "mitigates both passive surveillance RFC7258 and active attacks that attempt to divert DNS traffic to rogue servers".

It also uses the port 443 which is used in almost 99% of HTTPS traffic so if someone is trying to sniff your traffic using Wireshark it will be very difficult to identify the DoH traffic because it will be mixed with the normal HTTPS traffic (Websites).

Side note: It also prevents DNS Filtering, what I mean is that if there is some firewall in your network that filters specific domains (like malware sites), by using DoH the firewall will not be able to block any domain you enter.

The DNSCrypt FAQ website also has a good list of advantages and disadvantages of using DoH here but if you are just looking to prevent simple Wireshark sniffing, DoH is more than enough.

  • DoH: DNS-over-HTTPS
    – Fijxu
    Oct 4 at 18:41
  • 2
    This answer doesn't address SNI in the TLS handshake (to the real target website, after DoH), and this could give someone a false sense of security.
    – Spiff
    Oct 4 at 18:48
  • Absolutely, secure DNS is PART of securing traffic. certainly not securing traffic as as a whole. Oct 4 at 19:02
  • The statement about identifying DoH traffic being difficult is also false - securityweek.com/…
    – davidgo
    Oct 5 at 18:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .