diff --git a/README.md b/README.md
index a8476a7b1..efb5def84 100644
--- a/README.md
+++ b/README.md
@@ -195,13 +195,16 @@ And for DNS over HTTP/2 (DoH) use:
 ~~~ corefile
 https://example.org {
     whoami
+    tls mycert mykey
 }
 ~~~
 
+Note that you must have the *tls* plugin configured as DoH requires that to be setup.
+
 Specifying ports works in the same way:
 
 ~~~ txt
-grpc://example.org:1443 {
+grpc://example.org:1443 https://example.org:1444 {
     # ...
 }
 ~~~
diff --git a/core/dnsserver/server_https.go b/core/dnsserver/server_https.go
index 621bdca24..fb5933815 100644
--- a/core/dnsserver/server_https.go
+++ b/core/dnsserver/server_https.go
@@ -38,6 +38,9 @@ func NewServerHTTPS(addr string, group []*Config) (*ServerHTTPS, error) {
 		// Should we error if some configs *don't* have TLS?
 		tlsConfig = conf.TLSConfig
 	}
+	if tlsConfig == nil {
+		return nil, fmt.Errorf("DoH requires TLS to be configured, see the tls plugin")
+	}
 
 	srv := &http.Server{
 		ReadTimeout:  5 * time.Second,