DNS over HTTPS in a browser or app
How common it is: no child-specific prevalence located. DoH itself is standardized in RFC 8484. RFC 9490 identifies alternate encrypted resolver paths as a parental-control complication.
Detection
Expected DNS queries disappear while HTTPS traffic continues. With application DoH, the resolver exchange is carried over HTTPS and may resemble other HTTPS traffic.
Fix (technical)
Prefer managed endpoint policy when a browser/device supports locking resolver behavior. Network operators can block known unauthorized resolver endpoints, but this is maintenance-heavy and is not a c…
Fix (relational)
If the control depends on hidden DNS mechanics the child cannot understand, make the intended content rule explicit. Technical obscurity is not a substitute for a comprehensible household policy.
Residual risk
New resolver endpoints, VPNs, proxies and external networks can preserve an alternate path.
Sources
-
rfc8484-doh
-
rfc9490-mten