The Address Book Behind the Address Bar: DoH on Public Wi-Fi, Explained

You type a site name, hit Enter, and the page appears. Somewhere in that tiny gap, your browser has to turn a name like example.com into a numeric address it can actually reach. That lookup is DNS, and on public Wi-Fi it has traditionally been one of the easier things for a network operator to watch. DNS-over-HTTPS, usually shortened to DoH, wraps that lookup in encryption. It is a useful upgrade. It is also not a cloak of invisibility.

That distinction matters most when you are on a hotel network that wants you to sign in again, a coffee shop router with a mysterious name, or an airport Wi-Fi portal that seems to have opinions about which sites should load. DoH can help with one slice of the privacy puzzle. Treat it like the whole puzzle and you will expect too much from a browser setting.

What DoH actually does

DNS is the address book of the internet. Without it, your browser knows the name of the place you want to visit but not where to deliver the request. Normally, that lookup goes out in plain text. Whoever runs the network can see the domain names your device is asking about, even if they cannot read the encrypted page you eventually load.

DoH changes the delivery method. Instead of sending a plain DNS query, your browser sends it over an encrypted HTTPS connection to a DNS resolver that supports DoH. An observer on the Wi-Fi network sees that your device is talking to a resolver, but not the specific domain names inside that encrypted stream. That is the core benefit: fewer plain-text clues about where you are browsing.

It does not encrypt your actual web traffic. If you load a page over HTTPS, that page traffic is already encrypted between your browser and the site. DoH protects the lookup step. A proxy sits in a different part of the chain and routes traffic through another server. A VPN encrypts and routes broadly at the network level. DoH is narrower than either one.

The five-minute browser check

You do not need a networking lab to see what your browser is doing. Most major browsers now expose a secure DNS setting, though the labels vary.

1. Open your browser settings and search for DNS or secure DNS.
2. Find the secure DNS or DNS-over-HTTPS section. In many browsers it is under Privacy and Security.
3. Check whether it is off, set to your operating system, or pointed at a specific provider.
4. If it is on, note the provider. If it is off, decide whether you want to turn it on for this network.
5. Load a known site, then try the browser's own secure DNS test page or a reputable resolver test page to confirm the setting is active.

On a laptop, the browser setting may override the system setting. On a phone, the browser and the operating system can have separate DNS controls. That is why two devices on the same hotel Wi-Fi can behave differently even when they are sitting side by side.

A quick practical test: connect to the public Wi-Fi, turn DoH on in your browser, and try to reach a normal site. Then try the captive portal again. If the sign-in page refuses to appear, turn DoH off, finish the portal login, and then turn it back on. Captive portals are one of the most common reasons a privacy setting suddenly looks broken.

Where DoH helps on public Wi-Fi

On a hotel, cafe, or airport network, DoH is most useful against casual DNS snooping. It reduces the plain-text trail of domain names that the network can collect. If you are researching a medical question, reading about a sensitive local issue, or checking a personal account on a shared network, that is a real improvement over leaving every lookup in the open.

It can also help when a network's DNS resolver is flaky or oddly selective. Some public networks run resolvers that are slow, overloaded, or configured in ways that make ordinary browsing feel broken. Switching to a reputable DoH resolver can make name resolution more consistent, though it will not fix a weak signal or a congested access point.

DoH also travels well. If you use a laptop at a hotel and then move to a cafe, the browser setting follows you rather than the network. That consistency is handy for people who do not want to reconfigure privacy settings every time they buy a coffee.

What it leaves exposed

The network can still see which IP addresses your device connects to. It can see timing and traffic volume. It may see the server name in some encrypted connections, depending on the protocol and configuration. It can see that you are using a DoH resolver. And the resolver itself can see the domains you ask about, unless it has a policy of not logging them.

That last point deserves attention. DoH moves trust from the local Wi-Fi operator to the DNS provider. If the provider keeps detailed logs, you have not eliminated the record; you have changed who holds it. Choose a resolver with a clear privacy policy, and do not assume the word "secure" in a settings menu means "no logs."

DoH also does not hide your device from the network. The hotel router still knows a device is connected. It still sees when that device sends traffic. It just has less plain-text DNS information to work with.

Trade-offs before you flip the switch

Some networks rely on DNS filtering for content blocking, parental controls, or malware protection. Turning on DoH can bypass that filtering in your browser. That may be exactly what you want on a hotel network that blocks ordinary sites for no good reason. It may be a bad idea on a school, workplace, or library network where the filtering is part of the deal.

Enterprise networks can also break in subtle ways. Split-horizon DNS, internal company domains, and captive portals may depend on the local resolver. If you cannot reach an internal site or a sign-in page after enabling DoH, the setting is a likely suspect.

There is also a performance question. A nearby resolver may be faster than a distant encrypted one. Most people will not notice, but if pages feel sluggish after the change, test with DoH off and compare. Privacy settings should not make everyday browsing miserable.

The honest summary

DNS-over-HTTPS is a good default for many people on public Wi-Fi. It closes one plain-text window without pretending to be a full privacy suite. It is not a proxy, and it is not a VPN. It will not hide your IP address from the sites you visit, and it will not stop the Wi-Fi operator from seeing that you are online.

Use it as one layer: keep your browser updated, prefer HTTPS, avoid logging into sensitive accounts on networks you do not trust, and reach for a proxy or VPN when you need broader routing rather than just a quieter address lookup. The address book behind the address bar is worth protecting. Just remember that the rest of the trip still happens in public.