← Privacy Guides

Browsing & network

Encrypted DNS: hide which sites you look up

Turn your plaintext DNS lookups into an encrypted connection to a resolver you choose, so your network and internet provider can no longer read every domain name you visit; then understand the two things it still does not hide.

  • Medium threat
  • Time 25 minutes
  • Difficulty Moderate
  • Last verified

What this protects, and what it doesn't

Protects

  • Domain names on the local network: on open Wi-Fi or a shared network, others can no longer read your DNS queries in plaintext.
  • ISP visibility of lookups: your internet provider stops being the default resolver that sees and can log every site name you resolve.
  • DNS tampering: an encrypted, authenticated resolver is harder to spoof or redirect than classic port-53 DNS.

Does not protect

  • The destination IP still shows. After the lookup your device connects to the site's IP address, which your ISP can see; it can often infer the site from that alone.
  • The server name in TLS (SNI) is usually still in the clear, so the hostname can leak at connection time unless Encrypted Client Hello (ECH) is also in use.
  • You move trust, not remove it. The resolver you pick now sees all your queries, so choosing a trustworthy, no-logging resolver is the whole decision.
  • Browser-only DoH covers only that browser. Apps, the OS and other programs keep using the system resolver until you set it OS-wide or on the router.

Prerequisites

  • A device or router where you can change DNS settings (all current desktop and mobile OSes support encrypted DNS).
  • A resolver you have chosen and trust (see the step on picking one).

Step by step

  1. Know the three transports

    Encrypted DNS wraps the same lookups in an encrypted channel. Three standard transports exist:

    • DoH — DNS over HTTPS (RFC 8484): lookups ride inside normal HTTPS on port 443, so they blend in with web traffic. This is what browsers use.
    • DoT — DNS over TLS (RFC 7858): a dedicated TLS connection on port 853; easy for a network to see (and block) as DNS, but clean at the OS level. Android's "Private DNS" is DoT.
    • DoQ — DNS over QUIC (RFC 9250): the newest, over QUIC/UDP; lower latency, growing support.

    For privacy the transport matters less than which resolver you send everything to.

  2. Choose a resolver you trust

    Whoever you point encrypted DNS at now sees every domain you resolve. Pick one with a clear no-logging policy and a jurisdiction you are comfortable with. Commonly used options, each with its own documentation to read:

    • Quad9 (9.9.9.9): Swiss non-profit, blocks known-malicious domains, states it does not keep personal query logs.
    • Cloudflare 1.1.1.1: fast; independently audited privacy practices, with public-resolver logs deleted within 25 hours.
    • NextDNS / AdGuard DNS: configurable filtering; NextDNS logging is off unless you opt in. These involve an account if you customise.

    Avoid "free" resolvers with no stated policy; the whole point is the promise about logs.

  3. Turn it on OS-wide (covers everything)

    Setting it at the operating system or router level protects every app, not just the browser.

    • Android 9+: Settings → Network & internet → Private DNS → enter the resolver's DoT hostname.
    • Windows 11: Settings → Network & internet → your adapter → DNS server assignment → set DNS and choose "Encrypted only (DoH)".
    • Apple (iOS/macOS): install the resolver's signed DNS configuration profile (most provide a DoH/DoT profile), then enable it under Settings → General → VPN, DNS & Device Management.
    • Router: if your router supports DoH/DoT, set it there once to cover the whole home, including smart-home devices.

  4. Or just in the browser (quick, browser-only)

    If you only want it for web browsing:

    • Firefox: Settings → Privacy & Security → DNS over HTTPS → choose a provider and "Max Protection".
    • Chrome/Edge: Settings → Privacy and security → Security → "Use secure DNS" → pick a provider.

    Remember this leaves the rest of the system on plain DNS, so for real coverage prefer the OS or router step above.

  5. Close the SNI gap with ECH (where available)

    Even with encrypted DNS, the very next step — the TLS handshake — normally carries the site's hostname in the clear in the Server Name Indication (SNI). Encrypted Client Hello (ECH) encrypts that inner server name, using a key the site publishes in DNS. It needs the site to deploy it (Cloudflare is the main provider), a browser that supports it (Firefox 119+ with DoH on, Chrome 117+), and encrypted DNS to fetch the key privately. Where all three line up, the hostname is hidden too; where they do not, SNI still leaks. In Firefox, keep DoH on "Max Protection" and ECH follows.

  6. Verify it is actually on

    Confirm the change took effect. Cloudflare's 1.1.1.1/help page reports whether your connection is using DoH/DoT. Many resolver operators host a similar "is my DNS encrypted?" check page. If it shows plaintext, the setting did not apply (a VPN, another DNS app, or an OS override can win).

Common mistakes

  • Thinking encrypted DNS hides the sites you visit. It hides the lookups; the destination IP and (without ECH) the TLS SNI can still reveal them.
  • Enabling DoH in the browser only, then assuming the whole device is covered.
  • Pointing DNS at a resolver with no clear logging policy, which just hands your full browsing map to a new party.
  • Running encrypted DNS plus a VPN plus a third DNS app at once, so you cannot tell which resolver is actually used; keep one.
  • Using a malware-blocking resolver and then blaming it when a legitimate site breaks; test with a plain resolver before concluding.

Going further

A resolver with filtering doubles as network-wide ad and tracker blocking; see Ad and tracker blocking for the trade-offs of DNS-level blocking versus an in-browser blocker. If you want the destination IP hidden as well, that is the job of a VPN or Tor, not DNS; see VPN or Tor. For the whole-home setup, see Home network.