Cloudflare and Apple say they have developed a new protocol called Oblivious DNS-over-HTTPS, which decouples DNS queries from internet users for more privacy
Context & Ripple Effects
This announcement is the payoff to a two-year arc in DNS privacy. Cloudflare built the consumer foundation with its privacy-focused 1.1.1.1 resolver in 2018, but reporting since has flagged the core limitation: even with encryption, the resolving service itself still sees which user made which query, making DoH a partial fix at best. Oblivious DNS-over-HTTPS attacks exactly that gap by decoupling queries from users.
The timing matters for Apple specifically: weeks earlier it had to respond to backlash over macOS silently checking Developer ID certificates via OCSP and logging IP addresses, promising an encrypted protocol for 2021. ODoH is that promise taking concrete protocol form, with Cloudflare as the infrastructure partner.
First-order effects
- Cloudflare's resolver now processes queries it cannot tie back to individual users, removing the last visibility gap that made its own privacy service a single point of observation.
- Apple gains a technical answer to the certificate-checking privacy criticism it faced over OCSP logging, converting a defensive posture into a shippable protocol.
Second-order effects
- Other resolver operators face pressure to adopt oblivious relaying or cede the privacy-minded market to Cloudflare, repeating the dynamic that followed DoH's own rollout when obfuscation alone proved insufficient.
- Network operators and security vendors who rely on observing plaintext DNS lose further ground as both transport and identity become encrypted, tightening the case for their own encrypted-DNS responses.
Third-order effects
- If the pattern holds, DNS architecture splits into distinct roles — relay, resolver, client — with trust distributed across parties rather than concentrated in one provider, becoming the default expectation for any privacy-respecting name resolution.
- Protocol-level privacy fixes of this kind shift the battleground from individual company data practices toward industry standards, where adoption by one major platform player effectively sets the baseline for others.
The trend: Internet plumbing is being rebuilt so that infrastructure providers process traffic without being able to attribute it to individuals, with Apple and Cloudflare pushing DNS to be the first layer to make that split standard.