Encrypted DNS
Why it matters Encrypted DNS is often switched on with one setting, and sometimes already on by default. It genuinely protects you on the network, but it hands your whole diary to one company. Understanding that trade lets you pick a resolver on purpose instead of by accident.
Lesson 86 introduced encrypted DNS in a few lines. Here we look closer at who learns what, before and after.
Back to the receptionist. Ordinary DNS is like shouting your question across a busy office: everyone nearby hears it. Encrypted DNS is like whispering it through a private phone line straight to the receptionist. The office no longer hears, but the receptionist still does, and now you have chosen which receptionist.
DoH (DNS over HTTPS): DNS questions sent inside an ordinary HTTPS connection, on port 443. To the network it looks like any other secure web traffic.
DoT (DNS over TLS): DNS questions sent inside TLS on its own port, 853. It is just as encrypted, but easy to spot as DNS because of the port, so a network can block it more easily.
Before and after
| Who | Ordinary DNS | Encrypted DNS (DoH or DoT) |
|---|---|---|
| Your local network and provider | Read every question; can change answers | See only that you talk to a resolver; cannot read or change answers |
| The resolver you chose | Usually your provider, which reads every question | Reads every question, with your IP address and the time |
| The website | Nothing about your DNS | Nothing about your DNS |
So encrypted DNS does two things. It hides your questions from the network path. And it moves them: whoever runs your chosen resolver now holds the diary your provider used to hold. That can be an improvement, if the resolver promises not to keep logs and you trust it more. It is not the same as nobody knowing.
What encrypted DNS cannot hide
After the lookup, your device still connects to the site. The network sees:
- The IP address you connect to. A big site on its own addresses is easy to recognise from the address alone.
- The site name in the TLS handshake (SNI), from lesson 82, unless the site supports Encrypted Client Hello. ECH needs its key from DNS, so encrypted DNS is a building block for it.
- Sizes and timing of the traffic.
So encrypted DNS on its own closes one leak of three. Combined with ECH, the name is hidden too; the IP address still needs a relay or VPN, lesson 102.
Where it is switched on
Chrome and Firefox both have a secure DNS setting (checked October 2026). Chrome's default mode upgrades to encrypted DNS automatically when the resolver you already use supports it. Firefox turns DNS over HTTPS on by default in some regions. Phones and computers can also set it for the whole device, which also covers apps, not just the browser.
A newer design, Oblivious DNS over HTTPS, goes one step further: it sends your encrypted question through a relay, so the relay knows who you are but not what you asked, and the resolver knows what you asked but not who you are. Leg 7 builds that idea, called Oblivious HTTP, properly.
A common misconception: "encrypted DNS hides which sites I visit from my provider". It hides the questions, but the provider still sees the IP addresses you then connect to, and often the site name in the handshake. It narrows what the provider learns; it does not erase it.
Try it Open your browser settings and search for "DNS" or "secure DNS". Note which mode it is in (off, automatic, or a named provider). Then look at your operating system's network or Wi-Fi settings for a DNS or Private DNS option. Write down who receives your lookups today; you do not need to change anything.
Recap
- DoH and DoT encrypt DNS between you and your resolver, so the network cannot read or change answers.
- The resolver still sees every question: encrypted DNS moves your diary, it does not delete it.
- The IP address, the site name in SNI (without ECH), sizes and timing still leak.
- Choose the resolver on purpose, because it now holds the list.
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.