The way your device turns a website name into an address — DNS — leaks a surprising amount of information. Encrypted DNS protocols already hide the contents of those lookups from casual eavesdroppers, but a newer approach called Oblivious DNS over HTTPS (ODoH) takes privacy a step further by ensuring no single party can see both your IP address and your DNS queries.
How ODoH works, simply
ODoH combines two ideas: encryption of the DNS message so only the resolver can read it, and an intermediating proxy that forwards the encrypted query. Engineers from several major infrastructure companies co‑authored the specification, and there are reference implementations and documentation available publicly.
In practice the client encrypts the DNS query with the resolver’s public key and sends it to a proxy. The proxy only sees the client’s IP and the encrypted blob — it cannot read the query. The proxy forwards the blob to the resolver. The resolver can decrypt and answer the query, but it only sees the proxy’s IP, not the original client. The end result: no single entity has both the plaintext query and the client IP at the same time.
This is different from plain encrypted DNS (DoH, DoT, DoQ), where the transport is protected but the resolver still sees both your IP and the query. ODoH is sometimes described as “re‑association protection” — it raises the bar for anyone trying to link an IP to a particular lookup.
What this means for you (and what it doesn’t)
ODoH is a practical privacy improvement rather than a magic bullet. For ordinary users it reduces the ability of a DNS provider or an on‑path observer to compile crisp logs tying your IP to every hostname you request, without changing how websites or browsers behave.
A few important caveats:
- Trust shifts rather than disappears. You move some trust from a single resolver to a combination of a proxy and a resolver. Choose providers with clear privacy policies and transparent implementations. - It does not anonymise your traffic end‑to‑end. Web servers still see your IP, and other signals (cookies, browser fingerprints) can link activity across sessions. ODoH complements, but does not replace, other privacy measures such as HTTPS, tracker blockers or VPNs. - Performance and availability depend on deployment. Adding a proxy introduces another network hop; good implementations aim to minimise latency, but real‑world behaviour depends on how and where providers run the service.
If you care about DNS privacy, ODoH is one of the most promising options. To take advantage of it, watch for support from your operating system, browser or DNS provider — and look in the provider’s documentation for explicit ODoH support. Providers publishing code and clear policies are easier to evaluate.
ODoH represents a sensible architectural change: by separating the knowledge of “who” from the knowledge of “what”, it makes mass collection of DNS‑to‑IP linkages harder. For everyday users that’s a practical privacy boost without dramatic changes in how the internet feels to use.
