The problem with ordinary DNS

Every time you open a website, your device asks a DNS resolver to translate the name into an IP address. Traditional DNS sends that question and the answer unencrypted over UDP port 53.

Anyone on the path, such as a café network, an internet provider or malware on your router, can see which domains you look up. They can also answer with a different address, a technique called DNS hijacking, which is used for filtering, advertising redirects and phishing.

Many networks block websites at the DNS level by returning a false answer or a warning page. This is cheap for operators and invisible to most users.

How DoH and DoT work

DNS over TLS (DoT) wraps DNS queries in TLS encryption on a dedicated port, 853. DNS over HTTPS (DoH) sends them inside normal HTTPS traffic on port 443, so they look like any other web request.

Both protect queries from being read or modified between your device and the resolver. DoT is easier for network administrators to identify and manage; DoH is harder to block and is the method most browsers use.

Neither hides the website from the resolver itself, and the destination IP address and often the site name in the TLS handshake are still visible to the network.

  • DoT: encrypted DNS on port 853, used by Android Private DNS.
  • DoH: encrypted DNS inside HTTPS, used by Chrome, Edge, Firefox and Windows 11.
  • Both: protect against snooping and tampering on the path.
  • Neither: hides traffic from the resolver operator.

How to turn on encrypted DNS

In Chrome or Edge, open Settings, Privacy and security, Security, and enable Use secure DNS, then pick a provider such as Cloudflare or Google. In Firefox, search settings for DNS over HTTPS and choose increased or maximum protection.

On Android 9 and later, go to Settings, Network, Private DNS and enter a hostname such as one.one.one.one or dns.google. On iPhone, encrypted DNS is added with a configuration profile or an app from the resolver provider. On Windows 11, set the DNS server manually, then set DNS over HTTPS to On for that address.

Routers with DoH or DoT support protect every device at once, but many provider modems do not offer it.

Common encrypted DNS settings
Android Private DNS:  one.one.one.one   or   dns.google
DoH URL (Cloudflare): https://cloudflare-dns.com/dns-query
DoH URL (Google):     https://dns.google/dns-query
DoT (Quad9):          dns.quad9.net

How to check it is working

Run a DNS leak test. With encrypted DNS enabled in the browser, the resolvers shown should belong to the provider you chose, not your internet provider.

You can also compare results with a DNS lookup tool. If a domain resolves to a warning page on your normal connection but to a real address through your encrypted resolver, your network is altering DNS answers.

Remember that apps outside the browser may still use the system DNS unless you configure encrypted DNS at the operating system level.

Privacy trade-offs and limits

Encrypted DNS moves trust from your network to the resolver operator. Choose a provider with a clear privacy policy, and remember that it can still see every domain you query.

Encrypted DNS can bypass DNS-based filtering, but many blocks also work at the IP or SNI level, so some sites stay unreachable. Using it to access content may also be subject to local rules, so understand what applies to you.

Parental controls and company security filters that rely on DNS can stop working when devices switch to encrypted DNS, so families and businesses should configure filtering resolvers that support DoH or DoT instead.

Common questions

Is encrypted DNS the same as a VPN? No. It only protects DNS lookups; a VPN encrypts all traffic and changes your visible IP address.

Does it make browsing faster? Sometimes slightly, sometimes not. Its main benefit is privacy and integrity, not speed.

Should I use it on public Wi-Fi? Yes. It is one of the cheapest ways to stop the hotspot from reading or redirecting your lookups.