URL query parameters are encrypted by TLS. The domain is the part that isn’t encrypted.

the url should be covered by tls

What are you talking about