DNS over HTTPS (DoH)

Traditional DNS queries are plaintext — every ISP and router along the way can see where you go. DoH stuffs DNS queries inside HTTPS, so middleboxes only see an encrypted byte stream — they can't even guess the domain.