# Does DNS over HTTPS (DoH) really do much to prevent snooping?

**URL:** https://discuss.privacyguides.net/t/does-dns-over-https-doh-really-do-much-to-prevent-snooping/35764
**Category:** General
**Created:** 2026-02-25T22:10:10Z
**Posts:** 7

## Post 1 by @nikwunu — 2026-02-25T22:10:10Z

I tried opening websites with my web browser configured to use DoH, and had Wireshark listening. There’s a client hello for the websites visited and the site url is shown. Doesn’t that mean that network administrators, the router manufacturer, and the internet service provider can all see what websites the DoH user visits?

---

## Post 2 by @shadowwwind — 2026-02-25T22:45:13Z

I believe some ISPs just use Google as their DNS, in that case choosing a DNS provider yourself might be more private.

When DoH is enabled Firefox will use ECH if the website supports it. [[1]](#footnote-141540-1)

* * *

1. 

> **[Encrypted Client Hello (ECH) - Frequently asked questions | Firefox Help](https://support.mozilla.org/en-US/kb/faq-encrypted-client-hello)**
>
> Encrypted Client Hello (ECH) is a security feature in major Web browsers, available in Firefox 118 and enabled by default in Firefox 119. Learn more.

[↩︎](#footnote-ref-141540-1)

---

## Post 3 by @xe3 — 2026-02-25T23:32:19Z

My basic understanding is that encrypted DNS is most effective when paired with ECH[[1]](#footnote-141548-1). But even without ECH, there may still be meaningful _practical_ benefit to encrypted DNS on it’s own because it at least addresses the low hanging fruit, and a common way that ISPs snoop on you.

A (possibly dumb) analogy, is while it is most effective to lock your doors _and_ windows, if all you can do is lock your door, that is still a meaningful improvement that reduces the probability of a break in.

_edit: @FranklyFlawless’s explanation below is well written, succinct and clearer than mine._  
_Also adding this link to [Cloudflare’s encrypted SNI test page](https://www.cloudflare.com/ssl/encrypted-sni)_

* * *

1. “Encrypted Client Hello” [↩︎](#footnote-ref-141548-1)

---

## Post 4 by @FranklyFlawless — 2026-02-26T00:57:32Z

DoH(3) encapsulates your DNS query using TLS encryption over port 443, so that means passive MITM eavesdroppers are no longer able to easily and readily harvest that information nor tamper with it. ECH is separate and splits the ClientHello into an encrypted inner and unencrypted outer layer before accessing the TLS 1.3 server, meaning that passive MITM eavesdroppers would be able to see a generic SNI from the unencrypted outer ClientHello instead of the domain name within the encrypted inner ClientHello.

---

## Post 5 by @Encounter5729 — 2026-02-26T14:51:08Z

Which browser did you use ?

---

## Post 6 by @nikwunu — 2026-02-26T22:04:47Z

Mullvad DNS on Librewolf (Firefox) and NextDNS on Helium (Chromium).

---

## Post 7 by @lyricism — 2026-02-26T22:53:17Z

(Hot take warning)

Even ECH is not a silver bullet. It only helps with sites hosted on a shared IP which supports it (i.e. Cloudflare), but if you’re connecting with Cloudflare protected sites you are exchanging your ISP being able to identify the domain you are visiting for Cloudflare seeing the entirety of your connection. You are only exchanging one middleman for another.

Of course, practically speaking, you don’t control if a site uses Cloudflare, so for sites which do obviously it does remove a middleman as Cloudflare will be there anyway.

But, speaking more philosophically about it, the entire DoH/ECH paradigm requires entities like Cloudflare to function and I honestly don’t really buy that it serves any real benefit to the wider internet beyond acting as marketing material for Cloudflare.