Definition
DNS over HTTPS, standardized in RFC 8484, encapsulates DNS queries inside HTTPS connections to a DoH-capable resolver — typically Cloudflare's 1.1.1.1, Google's 8.8.8.8, Quad9, or NextDNS. From a network operator's perspective, the queries are indistinguishable from any other HTTPS traffic to those endpoints, making them resistant to monitoring and selective blocking.
DoH vs DoT
DNS over TLS (DoT, RFC 7858) achieves a similar goal but uses a dedicated port (853) and a distinctive TLS connection. This is cleaner protocol-wise but easier for network operators to identify and block. DoH deliberately blends in with web traffic. The trade-off is that DoT integrates well at the system level and is the choice of Android and most Linux setups, while DoH is favoured by browsers (Firefox, Chrome) and more difficult to censor.
Interaction with VPNs
When you are connected to a VPN, the VPN provider typically wants you to use its own DNS resolver inside the tunnel — DoH from the application layer can override that and leak queries directly to a third party. Most VPN clients now detect and disable browser DoH while the tunnel is active, or proxy DoH through the tunnel. Used together, VPN and DoH-via-the-VPN provide layered protection.