Oblivious DoH (ODoH): Split Your Query from Your Identity

Oblivious DNS over HTTPS (ODoH) is an opt-in method for separating a DNS request from the identity of the person or device making it. DNS, the Domain Name System, handles requests for the online destinations that devices want to reach. ODoH addresses a specific privacy weakness in ordinary DNS over HTTPS: although the request is encrypted while travelling across the network, the DNS resolver receiving it can still see both who sent it and what was requested.

A DNS resolver is the service that processes a DNS request and returns the information needed to reach the requested destination. With normal DNS over HTTPS (DoH), the device sends that request directly to the resolver through an encrypted HTTPS connection. This protects the request while it travels between those two points, but it does not hide the request from the resolver itself. The resolver is the endpoint of that protected exchange, so it can associate the requester with the requested destination.

ODoH changes this arrangement by inserting a relay, an intermediary that passes the protected DNS request between the device and the resolver. The device does not deliver the query directly to the resolver. Instead, it encrypts the query and sends it through the relay. The relay can tell who is contacting it, but it cannot read what that person or device requested. It then passes the encrypted request onward to the resolver.

The resolver occupies the other half of this deliberately divided view. It can process the DNS question, but it does not receive that question directly from the original device. As a result, the resolver knows what was requested but not who originally requested it. The relay knows who made contact but not the contents of the request. Neither side can match the user and the DNS query together.

This separation is the central privacy benefit of ODoH. A DNS request can reveal information about the destination a device is trying to reach. When one service can see both the requester and the request, those two pieces of information can be associated. ODoH splits them across two different roles, preventing either the relay or the resolver from having the complete picture on its own.

The DNS query is encrypted end to end, meaning that the intermediary carrying it cannot read its contents. ODoH also works over standard DoH, retaining the encrypted HTTPS transport while adding the relay and the extra identity separation. The important change is therefore not simply that encryption is present. Normal DoH already encrypts DNS traffic in transit. ODoH changes which participant can see each part of the exchange.

Its scope must also be understood accurately. ODoH protects the DNS query and the connection between that query and the user's identity. It does not protect or anonymise the whole internet connection. The traffic that follows a DNS request is outside this specific protection, so ODoH should not be treated as a complete privacy system for everything a device sends or receives.

ODoH is also an opt-in transport, not something that automatically applies to every DNS request. A user, device or service must choose to use it. It is important to distinguish an actual ODoH option from ordinary DoH because both encrypt DNS traffic, but only ODoH introduces the relay that divides knowledge of identity and query content.

For readers considering DNS privacy more broadly, AEU DNS offers private, secure DNS for everyone. Whatever service is selected, the useful question is not merely whether DNS is encrypted, but whether the chosen transport also prevents one participant from seeing both who asked and what they asked.