How Chromium DNS-over-HTTPS Stops Local Snooping

This article provides a complete overview of how the DNS-over-HTTPS (DoH) configuration in the Chromium web browser protects user privacy by encrypting domain name lookups. By encapsulating standard Domain Name System (DNS) queries inside secure HTTPS connections, Chromium prevents local network observers—such as attackers on public Wi-Fi, compromised routers, or strict local administrators—from seeing which websites a user is visiting. Below is a straightforward breakdown of traditional DNS vulnerabilities, how Chromium processes DoH requests, and the exact mechanisms that stop local network snooping.

The Problem with Traditional DNS

To understand how Chromium prevents snooping, it is first necessary to look at how standard DNS operates. When you type a website address into a browser, the browser must translate that human-readable domain name into a machine-readable IP address.

Traditionally, this request is sent in plaintext over UDP or TCP using port 53. Because these packets are completely unencrypted, anyone monitoring the local network can intercept them. Even if the target website uses HTTPS encryption, the initial DNS lookup exposes the exact domain name you are trying to visit to anyone listening on the same local area network (LAN).

How Chromium Implements DNS-over-HTTPS

Chromium includes a built-in asynchronous DNS client (known as the Secure DNS feature) that overrides the operating system's default plaintext DNS behavior. When DoH is enabled in Chromium, the browser alters the lookup process in three specific ways:

  1. TLS Encryption: Chromium establishes a Transport Layer Security (TLS) connection with a designated DoH resolver before sending any lookup data.
  2. HTTPS Formatting: The browser packages the raw DNS query as a standard HTTP GET or POST request.
  3. Port 443 Routing: Instead of sending the request out on port 53, Chromium transmits the query over port 443, which is the standard port for all secure web traffic.

How This Configuration Stops Local Observers

By changing how DNS queries are packaged and routed, Chromium neutralizes local network snooping through several distinct mechanisms:

  • Payload Encryption: Because the DNS query is wrapped inside an encrypted TLS session, a local observer running packet-capture tools (like Wireshark) can only see random, encrypted data. Both the requested domain name and the returned IP address are completely hidden from view.
  • Traffic Blending: Traditional DNS traffic is easy to isolate because it uses a dedicated port (port 53). Because DoH uses port 443 via HTTP/2 or HTTP/3, the DNS lookups blend in seamlessly with normal, encrypted web browsing traffic. Local network monitors cannot easily distinguish between a DNS query and standard webpage data flowing to the same IP address.
  • Bypassing the Local Router: On a standard network, your device automatically uses the local router (via DHCP) as its first stop for DNS resolution, allowing the router to log every site you visit. When Chromium is configured to use a specific DoH provider, it bypasses the local network's DNS server entirely. It sends the encrypted packet straight through the local router directly to the external DoH server, blinding the local router to the contents of the request.
  • Preventing Man-in-the-Middle (MitM) Tampering: Local attackers often snoop on DNS by spoofing responses, redirecting users to malicious sites. Chromium verifies the TLS certificate of the DoH resolver. If a local observer tries to intercept and decrypt the DNS traffic, the certificate validation will fail, and Chromium will block the connection rather than expose the query.

Chromium's Two Configuration Modes

The level of protection against local observers depends on how the "Use secure DNS" setting is configured in Chromium's privacy and security settings:

  • With your current service provider (Automatic Mode): Chromium looks at the local network's default DNS settings and checks a built-in list to see if that provider offers a DoH server. If it does, Chromium automatically upgrades to DoH. However, if a malicious local router provides a non-DoH DNS IP address, or blocks the DoH connection, Chromium may fall back to plaintext DNS, leaving the user vulnerable to snooping.
  • With Custom Provider (Strict Mode): The user manually selects a trusted DoH resolver (such as Cloudflare, Quad9, or Google) or inputs a custom DoH URI template. In this mode, Chromium completely ignores the local network's DNS recommendations and refuses to fall back to plaintext DNS. If a local observer tries to block the DoH traffic to force a plaintext lookup, the DNS resolution simply fails, ensuring that no domain lookups are ever leaked to the local network.