Question 1

What is DNS over HTTPS, and should I use it?

Accepted Answer

**DNS over HTTPS (DoH)** encrypts your DNS queries so that whoever carries your traffic cannot read which sites you are looking up. It closes a genuine privacy gap and shifts trust rather than eliminating it.

**The problem it addresses.** Conventional DNS is sent in **plain text**. Every lookup — every website, every app's backend, every device phoning home — is visible to your ISP, to anyone on the same Wi-Fi, and to any network in between. Even with HTTPS protecting the page content, the DNS query reveals **which site you visited**.

It is also **unauthenticated**, so responses can be tampered with — the basis of DNS hijacking and of some ISP-level redirection.

**How DoH works.** DNS queries are sent inside ordinary HTTPS requests to a DNS resolver that supports it. Because the traffic looks like normal web traffic on port 443, it is both encrypted and **difficult to distinguish or block** — which is a feature or a problem depending on your position.

**DoT (DNS over TLS)** does the same encryption on a dedicated port, which makes it identifiable and therefore easier for networks to manage — and easier to block.

**What it protects against:** passive surveillance of your browsing by your ISP or network operator; tampering with responses; and lookups being read on untrusted public Wi-Fi.

**What it does not do:**

**It does not hide which sites you visit from your ISP entirely.** The IP addresses you connect to are still visible, and **SNI** in the TLS handshake frequently reveals the hostname anyway unless encrypted client hello is in use.

**It does not make you anonymous.**

**It moves trust to the resolver.** Your DNS provider now sees everything your ISP used to. Choosing a large centralised provider means concentrating that visibility, which is the main criticism.

**What it breaks:** parental controls and content filters that work at the network level; enterprise security monitoring; split-horizon DNS on corporate networks; and ISP-level blocking, which is why it has been politically contentious in the UK.

**Practical advice:** it is worth enabling on untrusted networks; choose a resolver whose logging policy you have actually read; and check whether it conflicts with filtering you rely on.

Question 2

How is internet filtering and censorship actually implemented?

Accepted Answer

Through several techniques operating at different layers, each with different costs, different accuracy and different ease of circumvention — and most real systems combine them. The techniques, in

Question 3

What is HSTS, and why does it stop you bypassing a certificate warning?

Accepted Answer

HTTP Strict Transport Security is a instruction from a website telling your browser to only ever connect to it over HTTPS — and to refuse to proceed if anything is wrong, without offering you a way

Question 4

What does a DNS server actually do?

Accepted Answer

A DNS server translates names people can remember into the numeric addresses machines actually use to route traffic. Every connection you make begins with a lookup, and if that lookup fails nothing

Question 5

What is the difference between HTTP and HTTPS?

Accepted Answer

HTTPS is HTTP carried inside an encrypted and authenticated connection. The application protocol is the same; what changes is that a security layer sits underneath it, and that layer provides three

Question 6

Who issues SSL certificates, and what do they actually prove?

Accepted Answer

A certificate authority (CA) issues them, and what most certificates prove is narrower than people assume: control of the domain name, and nothing else. What a certificate contains. The domain name

Question 7

What is DNSSEC, and why isn't it everywhere?

Accepted Answer

DNSSEC adds cryptographic signatures to DNS records so a resolver can verify that an answer genuinely came from the domain's owner and was not altered in transit. It addresses a real weakness, and

Related Questions