Encrypted DNS and VPNs
Why it matters Encrypted DNS and VPNs are sold as privacy fixes, and both can help. But each moves trust from one party to another rather than removing it. Knowing who sees what, before and after, lets you pick the right tool and ignore the hype.
Think of DNS as the internet's phone book. Before your device can visit shopa.example, it has to look up the number (the IP address). Every site you visit starts with one of these lookups, so your list of lookups reads like a diary.
DNS: the Domain Name System: the service that turns names like shopa.example into IP addresses. The server that answers your lookups is called a resolver, usually run by your internet provider unless you choose another.
Encrypted DNS
Plain DNS lookups travel unencrypted, so anyone on your network path, such as café Wi-Fi or your provider, can read them and sometimes change the answers. Encrypted DNS wraps the lookup in an encrypted tunnel to the resolver.
Encrypted DNS (DoH, DoT): DNS lookups sent inside encryption. DoH is DNS over HTTPS; DoT is DNS over TLS. Both protect the trip between you and your chosen resolver.
Pros: the network path can no longer read or quietly change your lookups. It is also a building block for Encrypted Client Hello from lesson 82, since ECH keys are published in DNS.
Cons: the resolver still sees every lookup. You have moved your diary from your provider to whichever company runs the resolver, so choose one whose policy you trust. And the network still sees the IP addresses you connect to, plus the site name in SNI wherever ECH is not used.
Chrome and Firefox both have a secure DNS setting (checked October 2026). Chrome's default mode switches to encrypted DNS automatically when your current resolver supports it; Firefox turns DNS over HTTPS on by default in some regions. Phones and computers also offer it in system network settings.
VPNs
A VPN is like sending all your post in one big sealed sack to a forwarding office, which opens the sack and posts each letter onwards from its own address.
VPN: Virtual Private Network: an encrypted tunnel from your device to a VPN server. All your traffic goes through it, and websites see the VPN server's IP address instead of yours.
| Who | Without a VPN | With a VPN |
|---|---|---|
| Your local network and provider | Which sites you reach (IPs, often names) | Only that you use a VPN, and how much |
| The VPN company | Nothing | Which sites you reach (what your provider used to see) |
| The website | Your IP address | The VPN's IP address |
| Cookies, logins, fingerprinting | Work as usual | Still work as usual |
Pros: it hides your activity from an untrusted local network such as public Wi-Fi, and hides your IP address, and so your rough location, from sites.
Cons: the VPN company now sees what your provider used to, and you usually cannot check a "no logs" promise yourself. A VPN does nothing about cookies, logging in, fingerprints or tracking pixels, which is most of what Legs 1 to 3 covered. It can slow things down, some sites block VPN addresses, and, as Leg 1 showed, WebRTC (the browser feature for calls) can reveal a public IP address through a STUN request, so check that your VPN keeps that traffic inside the tunnel.
A common misconception: "a VPN makes me anonymous". If you log in to an account or keep the same cookies, sites still know it is you. A VPN changes who can see your traffic; it does not change who you are to the sites you use.
The deep half of the course (Leg 5) takes DNS, relays and VPNs further, including how two-hop relays split what any one company sees.
Try it Open your browser's settings and search for "DNS". Find the secure DNS option and see which mode it is in and which resolver it uses. You do not need to change it; just note who your lookups currently go to.
Recap
- DNS lookups reveal every site you visit; encrypted DNS hides them from the network path.
- Encrypted DNS moves your lookups to the resolver you choose, so trust the resolver.
- A VPN hides your traffic from the local network and your IP from sites, and shows it to the VPN company.
- Neither stops cookies, logins or fingerprinting.
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.