The Problem With Classic DNS
Traditional DNS queries are sent in plain text, usually over UDP port 53. Anyone between you and your resolver — the Wi-Fi operator, your internet provider or an attacker on the same network — can see which domains you look up and can tamper with the answers. Encrypted DNS closes that gap.
Two Main Standards
- DNS over TLS (DoT): wraps DNS in a TLS connection on its own port, 853. Because the port is dedicated, networks can recognize (and block) it easily.
- DNS over HTTPS (DoH): sends DNS queries as HTTPS requests on port 443, the same port as normal web traffic. It is harder to distinguish from browsing and harder to block.
Both encrypt the traffic between your device and the resolver. Neither changes how the resolver talks to authoritative nameservers.
What Encrypted DNS Does and Does Not Protect
- Protects: the content of DNS queries from eavesdropping and tampering on the local network and along the path to the resolver.
- Does not hide the sites you visit from the resolver operator itself — choose one whose privacy policy you trust.
- Does not hide the IP addresses you connect to, and the website name may still be visible in the TLS handshake.
- Is not the same as DNSSEC, which proves that answers are authentic but does not encrypt them. See DNSSEC explained.
How to Enable It
Browsers
Chrome, Edge and Firefox have a “secure DNS” or “DNS over HTTPS” option in their privacy or security settings. You can choose your current provider (if it supports DoH) or a specific one such as Cloudflare or Google.
Windows 11
In the network adapter’s DNS settings, enter a supported resolver such as 1.1.1.1 or 8.8.8.8 and set DNS over HTTPS to on.
Android
Settings → Network & internet → Private DNS. Enter a provider hostname such as dns.google or one.one.one.one. Android’s Private DNS uses DoT.
Apple Devices
iOS and macOS support encrypted DNS through configuration profiles, which some DNS providers offer for download, or through apps.
Our public DNS servers comparison lists the main providers and their addresses.
Considerations for Networks
Companies and schools often rely on their own DNS for filtering and security monitoring. Devices that use DoH directly bypass those controls. Administrators usually set a policy that disables browser DoH or points it to the organization’s own resolver.
Troubleshooting
If sites stop loading after enabling encrypted DNS, the network may be blocking port 853 or the DoH provider. Switch back to the automatic setting and check whether the problem disappears. For general DNS errors, see DNS server not responding.