Skip to main content
wilfordbrimley
New Member
December 23, 2025
Question

Block DoH without deep inspection

  • December 23, 2025
  • 1 reply
  • 458 views

Is it possible to block DoH (DNS over HTTPS) without using deep packet inspection? This would be for a guest network, so devices cannot be configured with the cert needed for DPI to function. 

1 reply

Cajuntank
Contributor III
December 23, 2025

So let's think about what you are asking. HTTPS operates over 443 and is encrypted. So the only way you know what's inside that port's encrypted traffic (to know what it even is as it might be DNS, it might be standard web traffic, etc...), is if you are able to decrypt it (deep packet inspection). Now, if the server(s) you are communicating to for DoH are known via a list of IPs or hostnames, then you can block access to those, but that has nothing to do with DoH and purely IP blocking and DNS filtering logic.