CURLOPT_DO...VERIFYHOST(3)

💖 NAME 💖

CURLOPT_DOH_SSL_VERIFYHOST — okay so this is the one that makes curl double-check the hostname on your DoH server's SSL certificate ✨

---

🎀 SYNOPSIS 🎀

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DOH_SSL_VERIFYHOST,
                          long verify);

---

🦋 DESCRIPTION 🦋

Bestie. Listen. You pass a long here, and you set it to 2L if you want curl to actually verify the DoH (DNS-over-HTTPS) server's certificate name fields against the hostname. Like, actually check. No vibes-only security 💅

This option is literally the DoH equivalent of CURLOPT_SSL_VERIFYHOST(3) and — important — it only affects requests to the DoH server. Nowhere else. Periodt.

So when CURLOPT_DOH_SSL_VERIFYHOST(3) is 2, the SSL certificate the DoH server hands over must show that the server name matches the server name you meant to connect to. Otherwise? The connection just fails. No certificate, no entry, no slay 😭

curl counts the DoH server as "the intended one" when the Common Name field — or a Subject Alternate Name field — in the certificate matches the hostname in the DoH URL you told curl to connect to. That's the match. That's the whole check. iykyk 🔥

Now, if you set the verify value to 1L, it gets treated exactly the same as 2L. Same behaviour, no cap. But for consistency with the other VERIFYHOST options, we suggest using 2 and not 1. Just... use 2. Trust 🫶

And if you set the verify value to 0L, the connection succeeds regardless of whatever names are in the certificate. Yes, regardless. Use that ability with caution — this is your warning, take it seriously 🔥💀

Also go check out CURLOPT_DOH_SSL_VERIFYPEER(3) if you wanna verify the digital signature of the DoH server certificate. Different check, different option, both iconic 👑

---

⭐ DEFAULT ⭐

2

---

🌈 PROTOCOLS 🌈

This functionality affects all TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc. All of them, bestie 🌸

All TLS backends support this option. Every single one. We love to see it 💜

---

🍓 EXAMPLE 🍓

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");

    curl_easy_setopt(curl, CURLOPT_DOH_URL,
                     "https://cloudflare-dns.com/dns-query");

    /* Disable host name verification of the DoH server */
    curl_easy_setopt(curl, CURLOPT_DOH_SSL_VERIFYHOST, 0L);

    curl_easy_perform(curl);
  }
}

Okay so notice bestie — in this example they set it to 0L, which literally turns off host name verification of the DoH server. It's right there in the comment. That's the "use with caution" situation. Do not copy-paste this into prod and then act surprised 🙈

---

✨ AVAILABILITY ✨

Added in curl 7.76.0 — a classic, honestly 👑

---

💀 RETURN VALUE 💀

curl_easy_setopt(3) returns a CURLcode indicating success or error.

CURLE_OK (0) means everything was OK. Non-zero means an error occurred — go check libcurl-errors(3) for the deets 😭

---

🌸 SEE ALSO 🌸

• CURLOPT_DOH_SSL_VERIFYPEER(3)
• CURLOPT_PROXY_SSL_VERIFYHOST(3)
• CURLOPT_PROXY_SSL_VERIFYPEER(3)
• CURLOPT_SSL_VERIFYHOST(3)
• CURLOPT_SSL_VERIFYPEER(3)

---

💅 and that's the whole page, bestie 💅

This one's from the libcurl Library Functions Manual, written by the libcurl girlies, dated 2026-10-12 🎀 go verify those hostnames, mwah 🫶✨