关于DNS-over-HTTPS隐藏访问网站域名及替代方案的技术咨询

Hey there! Let's break this down step by step so it's easy to follow.

Does DNS over HTTPS (DoH) hide the sites you visit from someone on the same WiFi? #

Short answer: Yes, for the most part — and specifically, it stops them from seeing your DNS queries via tools like Wireshark.

Here's why: Normally, DNS queries are sent in plaintext. Anyone on the same network can sniff these packets and see exactly which domain names you're looking up (like "example.com"). DoH wraps these DNS queries inside an encrypted HTTPS connection. So when you use DoH, someone with Wireshark will only see that you're sending traffic to your DoH server (e.g., Cloudflare's 1.1.1.1 or Google's 8.8.8.8 over HTTPS), but they can't read the actual domain name you're querying.

A quick caveat: If you're visiting a website that uses unencrypted HTTP (not HTTPS), the full URL will still be in plaintext. But most modern sites use HTTPS, which encrypts the actual content. Also, traditional HTTPS used to send the Server Name Indication (SNI) in plaintext — this tells the server which domain you're trying to reach. However, newer browsers support encrypted SNI (ESNI, now called ECH), which hides that too when paired with DoH.

Since you mentioned your DNS settings but didn't share details, just make sure you've actually enabled DoH on your device/browser and are using a DNS provider that supports it (like the ones I mentioned above).

What if DoH isn't an option? Alternatives besides VPNs #

If for some reason DoH doesn't work (e.g., your network blocks it), here are other ways to hide your site visits from local snoops:

• DNS over TLS (DoT): Similar to DoH, but it uses a dedicated TLS connection for DNS (port 853 instead of HTTPS's 443). Many operating systems (like Windows, macOS, Linux) and routers let you configure DoT servers directly. It provides the same level of DNS encryption as DoH.
• Encrypted SNI (ECH): As I mentioned earlier, enable this in your browser (Chrome, Firefox support it) to hide the SNI field in HTTPS connections. Pair this with DoH/DoT for full protection against domain snooping.
• Local DNS encryption proxies: Tools like dnscrypt-proxy run on your device, take all plaintext DNS requests from your apps, and convert them to encrypted DoH/DoT requests before sending them out. You just set your device's DNS to point to the local proxy (usually 127.0.0.1), and all your DNS traffic gets encrypted.
• Tor Browser: Tor routes your traffic through a network of volunteer nodes, which hides not just your DNS queries but also your IP address and the content you're accessing. It's slower than regular browsing, but it's great for strong privacy when you need it.

If you have more questions about setting up any of these, or if you can share details about your current DNS settings, feel free to ask — I can help you narrow it down!

备注：内容来源于stack exchange，提问作者Gopal S