Your DNS Is Hiding in HTTPS — This Is Why It Matters

Unmanaged DNS over HTTPS (DoH) is quietly breaking network security monitoring. When endpoints bypass your DNS resolvers and encrypt queries directly to external providers like Cloudflare or Google, your entire security stack—NGFWs, DNS filtering, and threat intelligence feeds—goes blind. This isn't theoretical; it's happening by default in modern browsers.

Technical Breakdown – TTPs (MITRE): T1573 (Encrypted Channel), T1041 (Exfiltration Over C2 Channel), T1071.001 (Application Layer Protocol: Web Protocols) – Visibility Gap: Traditional DNS monitoring (port 53) misses all DoH traffic on port 443, allowing malware to use DoH for C2 communication without triggering DNS-based detections – Attack Vector: Adversaries can leverage DoH to bypass corporate DNS filtering, exfiltrate data, or resolve malicious domains without leaving logs in your DNS infrastructure – Affected Systems: All endpoints with browsers supporting DoH (Chrome, Firefox, Edge) or OS-level DoH (Windows 11, macOS Ventura+)

Defense Implement a controlled DoH strategy: block external DoH providers at the firewall (known IP ranges for Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9) and deploy your own DoH resolver internally. This restores visibility while preserving encryption benefits. Monitor for DoH traffic on non-standard ports and unexpected TLS SNI fields.

Source: https://www.akamai.com/blog/security/2026/sep/your-dns-hiding-https-why-it-matters