DoH/DoT works by sending DNS queries over an HTTPS/TLS connection, encrypting the query and response, making it difficult for anyone to intercept or monitor the user’s DNS traffic.