In short: A regular DNS request is sent in plain text, so your internet provider and the owner of the Wi-Fi network can see which sites you open — even when the pages themselves load over HTTPS. Encrypted DNS means DNS over HTTPS (DoH) and DNS over TLS (DoT): they wrap the request in an encrypted channel, and a bystander on the line can no longer read your list of domains. You can turn it on for free in a couple of minutes — in Android settings, through a profile on iPhone, or right inside your browser. But encrypted DNS solves only one problem: it does not hide your IP from websites and does not encrypt the rest of your traffic. For full privacy it is combined with a VPN, which encrypts the whole connection and handles DNS inside the tunnel.
What is encrypted DNS in simple terms
DNS is the system that turns a readable site name into the numeric address of a server. When you type an address in the browser, your device first asks a DNS server where to find the site, and only then opens the connection. The problem is that by default this question travels in plain text over port 53 — with no encryption at all.
That means anyone who can see your traffic can also read the request: your provider, a corporate network admin, the owner of a coffee-shop hotspot. Even if the site works over HTTPS and the page content is encrypted, the list of domains you visit stays in the open. Site names alone paint a detailed picture of your interests — from your bank and pharmacy to messengers and employer.
Encrypted DNS closes exactly this leak. The request is packed into an encrypted channel, and a bystander on the line only sees that you are exchanging data with something, not the site names themselves. The two main standards for this are DNS over HTTPS (DoH) and DNS over TLS (DoT). How traffic is exchanged in general, and where DNS fits into it, is covered in detail in the article on how a VPN works.
Why encrypt DNS right now
For years DNS was the least protected part of the connection: sites moved to HTTPS long ago, while DNS requests still traveled in the open. This has started to change — major browsers have added support for secure DNS, and some enable it by default where possible.
The reason is simple: open DNS is a convenient source of data about a user. A request log shows which services you use and when, and such data has commercial value. In parallel, the ECH (Encrypted Client Hello) technology is developing: it also encrypts the site name when a connection is set up, and together with encrypted DNS it closes another gap through which domain names used to leak. To understand who collects digital traces and how, see the article on setting up a private browser.
DoH vs DoT: what's the difference
Both protocols encrypt the DNS request, but they do it differently, and that affects how visible the request is on the network.
- DNS over HTTPS (DoH) hides the request inside ordinary HTTPS traffic on port 443 — the same port every website uses. From the outside such a request is almost indistinguishable from loading a normal web page, so it is hard to single out and block.
- DNS over TLS (DoT) encrypts the request with the same solid TLS, but sends it over a dedicated port, 853. The contents are just as closed, but the network can see that this is specifically DNS traffic — it is easier to track and, if desired, restrict.
For an everyday user the privacy difference is small: both options hide the domain names themselves. DoH is more convenient on a smartphone and in a browser because it blends into normal traffic; DoT is more often used at the system level and in network hardware. Android supports DoT natively — it is the «Private DNS» option — while browsers and iOS work with DoH.
Encrypted DNS or a VPN: what to choose
Encrypted DNS and a VPN are often confused, though they solve different tasks. DoH and DoT encrypt only DNS requests — that is, they hide site names. A VPN encrypts all of your traffic and also carries DNS requests inside its own tunnel, so the provider sees neither the domains, nor the content, nor which services you connect to.
There is a second important difference. Encrypted DNS does not change your IP address — sites still see where you connect from. A VPN replaces your visible address with the address of its server and therefore hides your location from websites. What a tunnel does and does not give you is covered in the article on what a VPN protects against.
| Method | What it encrypts | Hides domains from the ISP | Hides your IP from sites |
|---|---|---|---|
| Plain DNS (port 53) | Nothing | No | No |
| DoH / DoT | DNS requests only | Yes | No |
| VPN | All traffic and DNS | Yes | Yes |
In practice it is not an either-or choice. A good VPN already includes DNS encryption inside the tunnel, so configuring DoH separately while the VPN is active is usually unnecessary. That is how the LiMP VPN server network is built: DNS requests go through the server together with the rest of the traffic and do not leak to the provider. How a VPN shuts down tracking by your carrier is described in detail in the article on protection from ISP tracking.
What encrypted DNS does not protect against
DNS encryption is a useful but narrow tool. It is important to understand its limits so you don't rely on it more than it can do.
- It does not hide the fact of the visit by IP. Even with encrypted DNS your traffic still goes to the site's IP address, and the server name can be partly exposed in the SNI field when a secure connection is established. Only a VPN or a separate name-encryption technology (ECH) closes this completely.
- It does not encrypt the rest of your traffic. Only DNS requests are protected; everything else stays covered by whatever encryption the site itself provides.
- Trust shifts to the DNS server. The provider stops seeing the requests, but the operator of the DNS service you chose does see them. That is why it matters to pick a resolver with a clear privacy policy.
- It does not close every risk of an open network. On public Wi-Fi other threats remain — from page tampering to interception of unencrypted data.
A separate trap is leaks. Even with a VPN or private DNS enabled, requests sometimes slip out around the protected channel. How to check for that is described in the guide on DNS leaks and how to fix them, and a related leak of your real address is covered in the piece on the WebRTC leak. Attacks where an intruder steps between you and the site and can swap answers are explained in the breakdown of the man-in-the-middle attack.
Public DNS resolvers: how they differ
A resolver is the very DNS server you trust with your requests. Several public services have long supported encryption and differ in focus: speed, threat filtering, or ad blocking.
- Cloudflare — 1.1.1.1. Focuses on speed and privacy and states that it does not keep a request log tied to the user. There is also a variant with malicious-domain filtering.
- Google Public DNS — 8.8.8.8. A fast, reliable resolver with wide coverage, though requests are handled by Google's infrastructure.
- Quad9 — 9.9.9.9. A non-profit service from Switzerland that blocks requests to known malicious domains, adding phishing protection.
- AdGuard DNS. Besides encryption, it filters ads and trackers at the DNS level, before the page even loads.
The choice depends on your priority: if you want maximum speed, Cloudflare or Google fit; if protection from malicious sites matters more, Quad9; if you want fewer ads, AdGuard. In any case, remember the resolver sees your requests, so trust only services with a clear policy.
How to enable encrypted DNS on your phone and browser
You can turn on private DNS for free and without third-party apps — using the system itself or your browser. Here is the order of steps for the main platforms.
Android. Open «Settings» → «Network & internet» (or «Connections») → «Private DNS». Choose the «Private DNS provider hostname» mode and enter the address of a trusted resolver — for example dns.google, one.one.one.one or dns.quad9.net. Android applies DoT across the whole system, so the setting covers all apps at once.
iPhone and iPad. iOS has no built-in switch, but the system supports DoH through a configuration profile or an app. The easiest way is to install a trusted DNS service's profile from the App Store or the resolver's official site — after installation a profile appears in «Settings» → «General» → «VPN & Device Management», and DNS encryption starts working for all apps.
Browser (Chrome, Firefox, Edge). In the security settings find the «Use secure DNS» (Secure DNS / DNS over HTTPS) option and pick a provider from the list or specify your own. Keep in mind: this DoH works only inside the browser, while other apps keep using the system DNS.
If you already use a VPN, a separate setup is usually unnecessary — DNS requests already go through the tunnel. This matters most away from home: why open networks are dangerous is covered in the article on staying safe on public Wi-Fi.
Checklist: private DNS without mistakes
- Pick a DNS service with a transparent policy: it must not store or sell your request history.
- Turn on DNS encryption on every device — phone, tablet, laptop — not just in the browser.
- Remember that DoH in the browser does not protect other apps: for system-wide protection, set DNS at the OS level.
- After setup, test the connection for leaks and confirm requests go through the resolver you chose.
- Do not treat encrypted DNS as a replacement for anonymity: it hides neither your IP nor the rest of your traffic.
- For full privacy, combine it with a VPN — then both requests and all traffic are encrypted and your address is hidden; see plans on the LiMP VPN pricing page.
- Watch your apps and smart devices: some reach out to a hard-coded DNS, bypassing your settings.
Frequently asked questions
Does encrypted DNS slow down the internet?
Usually the difference is unnoticeable, and sometimes the connection is even a touch faster thanks to a nearby resolver. On slow networks the first request to a new domain may take a little longer, but it does not affect everyday use.
Which DNS server should I choose?
Any well-known resolver with a clear privacy policy will do — Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9 (9.9.9.9) or services with ad filtering. The main thing is to trust the operator, since it is the one that sees your requests after encryption.
Do I need encrypted DNS if I already have a VPN?
You don't have to set it up separately: a quality VPN carries DNS inside the tunnel and encrypts requests together with the rest of the traffic. Configuring DoH is useful for the moments when the VPN is off.
Can the provider see sites when DoH is on?
The domain names themselves — no longer. But the provider still sees the IP addresses you connect to, and can sometimes guess the service from them. Only a VPN hides the destination address completely.
Is it safe to enter someone else's DNS address in the settings?
Only enter addresses of well-known resolvers taken from their official sites. A rogue DNS server, by contrast, can redirect you to fake pages, so the source of the address must be trustworthy.
How is encrypted DNS different from incognito mode?
They are different things. Incognito simply doesn't save history on the device, but it doesn't hide requests from the network. Encrypted DNS, on the contrary, hides site names on the network but changes nothing inside the browser and does not erase history.