SecDNS
Dashboard/Tools

Privacy

DoH Endpoint Tester

Probe an RFC 8484 DNS-over-HTTPS endpoint. Reports wire-format compliance, JSON support, HTTP status, and round-trip time so you can spot misconfigured DoH servers before users do.

Try a preset:

Probe result

Enter a value above to run a lookup.

Frequently asked questions

What is DoH?

DNS-over-HTTPS (RFC 8484) tunnels DNS queries inside HTTPS so that local network observers can no longer inspect or modify them. It’s the protocol behind Cloudflare’s 1.1.1.1 mobile app, Firefox’s Trusted Recursive Resolver, and SecDNS’ DoH endpoints.

How does the tester work?

We issue a GET against your DoH URL with `?dns=` set to a base64url-encoded wire-format probe (an A query for example.com). RFC 8484 requires Content-Type: application/dns-message. We also try the JSON variant (Accept: application/dns-json) so you can see if both modes work.

Why does my DoH endpoint return 200 but the test fails?

A 200 with the wrong Content-Type is the most common bug — the endpoint is HTTPS-reachable but not RFC-compliant. Resolvers will reject it. Other failures: missing trailing slash on the path, /dns-query expected but only / served, or CORS not allowing the dns-message header.

Can I test a private DoH server?

Yes — anything that resolves over the public internet works, as long as it’s HTTPS. The test runs server-side from SecDNS so you don’t need to expose CORS for browsers.

What about DoT or DoQ?

DoT (port 853 TLS) and DoQ (QUIC) are not exercised by this tool. SecDNS terminates DoH and DoT for hosted profiles — see the Privacy resolver tools for the matching health check.