DNS over HTTPS (DoH) is a way to encrypt DNS queries via the HTTPS protocol, so no one along the way can see which domain names you visit. For entrepreneurs and website administrators, this means more privacy for visitors, but it also requires attention when it comes to DNS changes, caching, and troubleshooting. Below you’ll read how DoH works, why it matters, and what you need to check in practice.
What is DNS over HTTPS
Normally, a device sends DNS queries (‘where is tandata.io?’) unencrypted to a DNS server. Anyone who can see the network traffic — an internet provider, an administrator of public wifi, or a malicious actor on the same network — can see which domains are being requested. DNS over HTTPS wraps this query in an encrypted HTTPS connection, just like your browser already does when loading a website itself.
The result: the content of the DNS query is invisible to intermediate parties. Only the DoH server being connected to (for example that of a browser or operating system) sees which domain is being requested. This is a different mechanism than DNSSEC, which guarantees the authenticity of DNS answers but does not encrypt anything.
Why DoH matters for entrepreneurs
For a webshop or business website, DNS operates in the background, but its reliability directly determines whether customers can reach your site and email. DoH doesn’t change how your domain and DNS records are set up, but it does change how visitors look them up: via the browser or operating system instead of via the internet provider’s DNS server.
This has two practical consequences. First, content filtering or monitoring at the network level (for example at businesses or schools) may work less effectively, because DNS traffic is no longer visible to the network administrator. Second, troubleshooting DNS issues may proceed slightly differently, because not every device uses the same DNS server to look up a domain.
Most visitors to your website won’t notice anything: they’ll simply see the correct page, just more privately. As an administrator, it’s mainly important to know that DNS changes, such as adjusting an A record or MX record, don’t become visible everywhere at the same speed because different DoH providers apply their own caching.
Consequences for management and troubleshooting
When managing domain names and email, it’s good to realize that ‘flushing DNS’ on your own PC doesn’t always help if the browser uses its own DoH resolver that is separate from the operating system. Chrome and Firefox, for example, have their own settings for DoH, which differ from what is configured at the network level.
This is especially relevant when verifying email records such as SPF, DKIM, and DMARC, and when checking an internet.nl score for your business email. If you’re unsure whether a change is already active, check with a separate DNS lookup tool instead of relying solely on what your browser shows.
This is also relevant when switching to a new hosting provider: during the DNS record transition period, visitors using different resolvers may temporarily still see the old server or already see the new one. A calm, planned transition with sufficiently low TTL values prevents confusion.
Check your current DNS settings
Review your A, MX, and TXT records in the control panel of your domain name or hosting provider before making any changes.
Lower the TTL for a change
Temporarily set the TTL value low so that changes propagate faster to various resolvers, including DoH providers.
Make the change
Adjust the record in Plesk or your domain management and note the time of the change.
Test via multiple networks
Check the result from a different wifi network, mobile data, and possibly a separate DNS lookup tool.
Set the TTL back to normal
Raise the TTL again once you’re sure the change is visible everywhere.
What you need to do concretely
As the owner of a website or webshop, you don’t need to configure DoH yourself; that happens on the browser or operating system side of your visitors. What is in your hands is making sure your own DNS records are correct and up to date, and that you know how to test changes once DoH comes into play.
Make sure your domain names, A records, and MX records are managed clearly in one place. In Plesk, the control panel used with web hosting, you’ll find these settings under the DNS management of your domain. Combine this with a correct configuration of your business email, including SPF, DKIM, and DMARC, so your email scores well on internet.nl, regardless of which resolver a receiving mail server uses to look up the records.
If you have doubts about your current DNS setup or want to switch to a provider that keeps this organized for you, check out the options for switching to Tandata or consult the knowledge base for step-by-step explanations of DNS management.
Frequently asked questions
Do I need to enable DoH myself on my server?
No, DoH is something used on the visitor’s side (browser or operating system) to encrypt DNS queries. As a website administrator, you don’t need to configure anything for this.
Does DoH work together with DNSSEC?
Yes, they are complementary techniques. DNSSEC guarantees that a DNS answer is genuine and unaltered, while DoH encrypts the query itself so no one along the way can read it.
Why don’t I see a DNS change immediately for a visitor?
This is often due to caching based on the TTL value of the record, combined with the fact that a DoH resolver may cache separately from the local internet provider.
Does DoH affect my email or internet.nl score?
Not directly. However, make sure SPF, DKIM, and DMARC are set up correctly, so receiving mail servers, regardless of the resolver used, can properly verify your email.
Can I check whether my DNS records are being correctly retrieved everywhere?
Use an independent DNS lookup tool and test from different networks and devices to be sure a change has been applied everywhere.
Conclusion
DNS over HTTPS encrypts DNS queries and improves visitor privacy, without requiring any changes to your own DNS configuration as a website administrator. However, it’s important to understand how caching and resolvers work, so you can properly test DNS changes for your web hosting, domain names, and business email before assuming they’re visible everywhere.