Skip to content

Browsers use DoH, IT wants to know what it means for monitoring and filtering

DNS over HTTPS hides DNS queries inside HTTPS traffic to an external resolver. Good for privacy on the road, but it bypasses your on-prem DNS filter (Pi-hole, NextDNS, AD policies) and makes incident response harder when you cannot see what a host asks.

Try this first

  1. 1Inventory where DoH is already active: Chrome, Firefox, Edge and Windows 11 sometimes ship it on by default, sometimes behind a flag.
  2. 2In an office with AD: push group policy 'Configure DNS over HTTPS' to Off for managed devices, and route them through your internal resolver.
  3. 3For laptops off-network: pick one approved DoH resolver (NextDNS, Cloudflare for Teams) so you have policies and logs.
  4. 4Block unknown DoH endpoints at the firewall via DNS-resolver blocklists, so clients cannot quietly use any resolver.
  5. 5Communicate the reasoning to users: this is not privacy-hostile, it is required for security monitoring and compliance.

When to bring us in

If you want a DoH strategy that works at the office and on the road without blinding IT, we can deploy NextDNS or similar.

See also

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.

Who are you?

For the AI question we need your email and company, so we can follow up if the AI gets stuck, and to prevent abuse.

Limited to 2 questions per hour and 5 per day, kept lean so the AI stays useful. For more, contacting us directly works better for you and us.

Or skip the DIY entirely

Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.