DNS over HTTPS (DoH) and DNS over TLS Explained

DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt the DNS lookups your device makes, so people on the network path, such as other Wi-Fi users or your ISP, can no longer read or tamper with the names you look up. DoH hides DNS inside ordinary HTTPS traffic on port 443, while DoT uses a dedicated port, 853.

Classic DNS was designed in the 1980s without encryption. Every lookup, such as "what is the address of example.com?", travels in plain text over UDP or TCP port 53. This guide explains how encrypted DNS works, what it does and does not protect, and how to switch it on across operating systems and browsers.

Why plain DNS is a privacy problem

Because traditional DNS is unencrypted, anyone who can see your traffic can see the list of domains you visit, and anyone positioned on the path can alter the answers. In practice this means:

• A public Wi-Fi operator, or another user on an open network, can log your lookups.
• An ISP can record, sell or redirect queries, for example sending mistyped domains to an advertising page.
• An attacker on the same network can spoof responses and send you to a fake server.

Encrypted DNS protects the leg between your device and the resolver you choose. It does not change what the resolver itself can see.

How DoH and DoT work

DNS over TLS (DoT)

Defined in RFC 7858, DoT wraps standard DNS messages in a TLS connection to the resolver on TCP port 853. The client checks the resolver's certificate, typically against a hostname such as dns.example.com, which prevents an attacker from impersonating it.

DNS over HTTPS (DoH)

Defined in RFC 8484, DoH sends the same binary DNS message as the body of an HTTPS request (media type application/dns-message) to a URL called a template, such as https://dns.example.com/dns-query. It uses port 443 like any website, and can run over HTTP/2 or HTTP/3.

DNS over QUIC (DoQ)

A newer option, RFC 9250, carries DNS over QUIC on UDP port 853. Support is growing but still less common than DoH and DoT.

What encrypted DNS does not do

• It does not hide you from the resolver. The DoH or DoT provider sees every query, so you are moving trust from your ISP to that provider. Read its logging policy.
• It does not hide the sites you connect to. Your ISP still sees the IP addresses you connect to and, unless the site supports Encrypted Client Hello, the hostname in the TLS handshake (SNI).
• It does not prove answers are genuine. Encryption protects the hop to the resolver; DNSSEC lets the resolver verify that records were signed by the domain owner. They solve different problems and work well together. You can see whether a domain is signed with our DNSSEC checker.
• It does not replace a VPN or make you anonymous.

Enable encrypted DNS on Windows 11

1. Open Settings → Network & internet, then select Ethernet, or Wi-Fi → your network's Hardware properties.
2. Next to DNS server assignment, click Edit and choose Manual.
3. Turn on IPv4 and enter a resolver that supports DoH, for example 1.1.1.1 or 8.8.8.8.
4. Set the encryption option, labelled DNS over HTTPS or Preferred DNS encryption depending on the build, to "On (automatic template)" or "Encrypted only". Repeat for IPv6 if you use it.

Windows only fills in the template automatically for resolvers it knows. List them, or add your own, in PowerShell:

Get-DnsClientDohServerAddress
Add-DnsClientDohServerAddress -ServerAddress 198.51.100.53 -DohTemplate https://dns.example.com/dns-query -AllowFallbackToUdp $false -AutoUpgrade $true

Android: Private DNS

Android 9 and later include Private DNS, which uses DoT. Go to Settings → Network & internet → Private DNS (on some phones under Connections → More connection settings) and choose:

• Automatic: uses DoT with the network's own resolver when it supports it, and falls back to plain DNS otherwise.
• Private DNS provider hostname: enter a hostname, not an IP, such as one.one.one.one or dns.google. Lookups fail rather than fall back if the server is unreachable.

Recent Android versions can use DoH for some well-known providers, but the setting still takes a hostname. It applies to Wi-Fi and mobile data alike.

iPhone, iPad and Mac: configuration profiles

Since iOS 14 and macOS 11, Apple devices support DoH and DoT system-wide, but there is no simple toggle. Encrypted DNS is enabled by an app that uses Apple's DNS settings API or by a configuration profile (.mobileconfig) containing a DNS settings payload:

<key>PayloadType</key>
<string>com.apple.dnsSettings.managed</string>
<key>DNSSettings</key>
<dict>
  <key>DNSProtocol</key>
  <string>HTTPS</string>
  <key>ServerURL</key>
  <string>https://dns.example.com/dns-query</string>
</dict>

Many resolver operators publish ready-made profiles. On iPhone, download the profile, then install it under Settings → General → VPN & Device Management. On a Mac, open the file and approve it in System Settings under Profiles or Device Management, depending on the macOS version. Install profiles only from sources you trust, since they can change system settings.

Linux with systemd-resolved

systemd-resolved supports DoT. Edit /etc/systemd/resolved.conf:

[Resolve]
DNS=1.1.1.1#cloudflare-dns.com 2606:4700:4700::1111#cloudflare-dns.com
DNSOverTLS=yes

Then run sudo systemctl restart systemd-resolved and check with resolvectl status, which should show +DNSOverTLS.

Browsers: Chrome, Edge and Firefox

Browsers can use DoH independently of the operating system:

• Chrome: Settings → Privacy and security → Security → Use secure DNS. "With your current service provider" upgrades to DoH only if your configured resolver supports it; otherwise pick a provider or enter a custom template URL.
• Edge: Settings → Privacy, search, and services → Security → Use secure DNS, with the same options.
• Firefox: Settings → Privacy & Security → DNS over HTTPS. Choose Default Protection, Increased Protection (falls back to your normal DNS if DoH fails), Max Protection (never falls back) or Off, and pick a provider or custom URL.

To confirm what a browser is doing, open about:networking#dns in Firefox (the TRR column shows lookups made over DoH) or chrome://net-internals/#dns in Chrome and Edge.

Testing encrypted DNS from the command line

dig @1.1.1.1 +tls example.com A          # DoT, BIND 9.18 or later
dig @1.1.1.1 +https example.com A        # DoH, BIND 9.18 or later
curl --doh-url https://1.1.1.1/dns-query https://example.com -I

Compare the answers with our DNS lookup tool. If you use a VPN, also run a WebRTC leak test, since encrypted DNS does not stop the browser revealing your address through other channels.

Enterprise networks and parental controls

Many networks rely on seeing DNS: companies resolve internal names with split-horizon DNS and block malicious domains, and parental-control or ad-blocking filters often work at the DNS level on the router. A browser that sends DoH straight to a public resolver bypasses all of that, so internal sites stop resolving and filters stop applying.

• Managed devices: Chrome and Edge honour the DnsOverHttpsMode and DnsOverHttpsTemplates policies, and Firefox the DNSOverHTTPS policy, so administrators can disable DoH or point it at an internal resolver.
• Canary domain: Firefox checks use-application-dns.net. If the network's resolver returns no address for it, Firefox does not turn on DoH by default; a user who enabled it manually is unaffected.
• Network blocking: DoT is easy to block on port 853. DoH can only be blocked by denying known resolver addresses and hostnames, which is never complete.
• Families: many filtering DNS services offer their own DoH and DoT endpoints, so a filter can be kept while still encrypting lookups. Configure it on each device, or lock browser settings where possible.

Frequently asked questions

Is DoH better than DoT?

The encryption is equivalent. DoH is harder for networks to block because it looks like web traffic; DoT is easier for network administrators to identify and manage. Use whichever your devices support.

Does encrypted DNS slow down browsing?

Setting up the TLS connection adds a little delay to the first lookup, but connections are reused, so later queries are typically about as fast as plain DNS. Resolver distance and caching matter more.

Can my ISP still see which websites I visit?

Partly. It can no longer read your DNS queries, but it sees the IP addresses you connect to and, for most sites, the hostname in the TLS handshake. A VPN hides both from the ISP, shifting that visibility to the VPN provider.

Will encrypted DNS fix a DNS leak?

It encrypts the queries, but if they still go to your ISP's resolver rather than your VPN's, the ISP can still read them at its end. See our guide to DNS and WebRTC leaks.