Cloudflare and Apple say they have developed a new protocol called Oblivious DNS-over-HTTPS, which decouples DNS queries from internet users for more privacy
Engineers at Cloudflare and Apple say they've developed a new internet protocol that will shore up one of the biggest holes …
Context & Ripple Effects
This announcement is the third act in Cloudflare's DNS privacy push: it launched the free consumer resolver 1.1.1.1 in 2018, then added one-click DNSSEC setup to harden spoofing defenses. But as Wired noted, plain DoH was no silver bullet — the resolving service still saw unencrypted requests tied to users.
First-order effects
- Oblivious DNS-over-HTTPS closes that gap by decoupling queries from user identities, meaning Cloudflare's resolver can no longer link a lookup to the person making it.
- For Apple, the protocol lands weeks after its OCSP logging response, where it stopped logging IP addresses and promised an encrypted protocol for 2021 — ODoH is that promise taking shape.
Second-order effects
- Other DNS providers now face a privacy benchmark set by two of the most trusted consumer brands: offer oblivious resolution or cede the privacy-focused segment Cloudflare has cultivated since 1.1.1.1.
- The protocol pressures app and OS vendors to route their own lookups through decoupled resolvers, since Apple's move shows platform makers are being held to what their network traffic reveals.
Third-order effects
- If ODoH follows DoH into mainstream browsers and operating systems, DNS shifts structurally from a service where one operator sees everything to a split design where no single party holds both query content and client identity.
- Adoption remains the open question — Cloudflare's own DNSSEC push showed how slowly new DNS protocols spread even with one-click tooling, so ODoH's impact depends on whether platforms ship it by default rather than as an opt-in.
The trend: DNS privacy is evolving from encrypting queries (DoH) to severing the link between query and querier entirely, with platform vendors like Apple turning resolver design into a competitive privacy feature.