Encrypted DNS: DoH, DoT and DoQ Explained, With Setup Steps

Encrypted DNS protects the lookup between your device and its DNS resolver. It makes those queries harder for a Wi-Fi operator or internet provider to read or alter, but the resolver still sees them. Other traffic can also reveal which sites you visit, so this is one privacy improvement, rather than complete browsing privacy.

Every time you open a website, your device first asks a DNS resolver to turn a name like techzei.com into an IP address. For most of the internet’s history, that question has travelled in plain text over UDP port 53. Anyone on the path can read it, log it or change the answer. Encrypted DNS wraps the same question in TLS, the encryption that already protects HTTPS websites.

DoT, DoH and DoQ carry DNS queries over encrypted connections. The useful choice is the one your device supports reliably, with a resolver whose logging and filtering policies suit you.

What plain DNS gives away

A plain DNS query contains the full name you are looking up. Your resolver sees it, and so does every network in between. On a café or airport network, that means the hotspot operator. At home, it usually means your internet provider, because most routers hand out the provider’s own resolver by default.

Three practical problems follow from that:

• Logging and profiling. A list of domains is a surprisingly detailed record of what you read, which bank you use and which apps are on your phone.
• Tampering. A network can return a different answer, for example a redirect page, an ad-filled search page for a mistyped domain, or a block page.
• Spoofing. On an untrusted network, an attacker can try to answer your DNS query before the real resolver does and send you to a fake site.

Encryption fixes the first two problems between your device and the resolver you choose, and makes the third much harder. It does not stop the resolver itself from seeing your queries. You are moving trust from your network to the resolver, which is why the choice of resolver matters as much as the protocol.

DoT, DoH and DoQ: how each one works

DNS over TLS (DoT)

DoT was standardised in RFC 7858 in 2016. Your device opens a TLS connection to the resolver on TCP port 853 and sends ordinary DNS messages inside it. The dedicated port is both its strength and its weakness. It is simple and easy for network administrators to identify, which also makes it easy for a restrictive network to block.

RFC 8310 later defined two ways for a client to use DoT. In strict mode, the client checks the resolver’s certificate against a hostname you supplied, and fails rather than falling back to plain DNS. In opportunistic mode, the client tries encryption but accepts plain DNS if it cannot get it. That difference is exactly what separates Android’s “Automatic” and “Private DNS provider hostname” options.

DNS over HTTPS (DoH)

DoH, defined in RFC 8484 in 2018, sends DNS messages as HTTPS requests to a URL called a URI template, such as https://cloudflare-dns.com/dns-query. It uses port 443, the same port as every secure website, and the application/dns-message content type. It works over HTTP/1.1, HTTP/2 or HTTP/3.

Because DoH looks like normal web traffic, a network cannot easily single it out and block it. That is good for privacy on hostile networks and the main reason browsers adopted it. It is also why some companies and schools dislike it: DoH inside a browser can bypass the DNS filtering they rely on.

DNS over QUIC (DoQ)

DoQ is the newest of the three, published as RFC 9250 in May 2022. It runs DNS directly over QUIC, the transport underneath HTTP/3, on UDP port 853. QUIC sets up encrypted connections faster than TCP plus TLS and avoids head-of-line blocking, where one slow answer holds up every answer behind it on the same connection. It also copes better when a phone switches between Wi-Fi and mobile data.

Support is still thin. Among the big public resolvers, AdGuard DNS and NextDNS offer DoQ, while Cloudflare’s and Google’s documentation list only DoH and DoT. No major desktop or mobile operating system has a built-in DoQ setting yet, so you need a client app or a router that supports it.

Side-by-side comparison

In privacy terms, all three encrypt the query between you and the resolver equally well. The real differences are how easily the traffic is noticed or blocked, and how quickly a connection is set up. Do not expect a dramatic speed change. Once a connection is open, encrypted DNS adds very little delay, and choosing a resolver that is close to you matters more than the protocol.

What encrypted DNS does not hide

Encrypting DNS removes one leak, not all of them. It helps to know the others before deciding how far to go.

• The resolver still sees everything. Pick one whose logging policy you are comfortable with.
• IP addresses are visible. Your provider can still see which servers you connect to. On shared hosting and big CDNs, one IP can serve thousands of sites, but a dedicated IP gives the site away.
• The website name can leak in the TLS handshake. Most HTTPS connections still send the site name in plain text in a field called Server Name Indication (SNI). Encrypted Client Hello fixes this, and is covered later.
• It is not a VPN. A VPN hides your traffic from the local network and moves your apparent location. Encrypted DNS does neither.

Choosing a resolver

You can use encrypted DNS with almost any large public resolver. The ones below all publish official DoH and DoT endpoints. The addresses come from each provider’s own documentation.

IPv6 addresses for each are on the providers’ pages. Cloudflare’s are 2606:4700:4700::1111 and 2606:4700:4700::1001, and Quad9’s main ones are 2620:fe::fe and 2620:fe::9.

Which should you pick? Cloudflare and Google are the fast, no-filtering choices with very large networks. Quad9 is a non-profit based in Switzerland and adds malware blocking by default, which suits family devices. AdGuard DNS blocks ads system-wide on phones that cannot run an ad blocker. NextDNS is for people who want their own block lists and a log they can read, per device. If you want ad blocking on an iPhone without paying for an app, our older guide to system-wide ad blocking on iOS works on the same principle.

How to turn on encrypted DNS on Android

Android 9 introduced Private DNS with DNS over TLS. Compatible Android 11 and later devices can also use DNS over HTTP/3 with supported resolvers after Google Play system updates. The setting still asks for a provider hostname; you do not paste a DoH URL into it.

1. Open Settings and go to Network & internet. On some phones it is under Connections or More connection settings.
2. Tap Private DNS.
3. Choose Private DNS provider hostname.
4. Type a DoT hostname such as one.one.one.one, dns.google, dns.quad9.net or dns.adguard-dns.com.
5. Tap Save.

Two things trip people up. First, Android wants a hostname, not an IP address and not a DoH URL, so https://dns.google/dns-query will be rejected. Second, this is strict mode. If the configured resolver is unreachable, lookups can fail until you restore a working setting. A network blocking port 853 can cause this when the device uses DoT. Samsung, Xiaomi, OnePlus and others move the menu around, but the setting is always called Private DNS, so searching Settings for “Private DNS” is the fastest route.

Private DNS applies to Wi-Fi and mobile data, for every app. Apps that use their own DNS, such as some browsers with DoH switched on, skip it.

How to turn on encrypted DNS on iPhone and iPad

iOS has no simple encrypted DNS switch. Apple added system-wide DoH and DoT in iOS 14, but you turn it on by installing a configuration profile, or by using an app that installs one for you.

Option 1: Install a resolver’s profile

AdGuard, NextDNS and several other providers offer a downloadable profile. The steps on the iPhone are the same for any profile:

1. Download the profile in Safari from the provider’s official site. iOS will say the profile was downloaded.
2. Open Settings. A shortcut to the downloaded profile appears near the top. If it does not, go to Settings > General > VPN & Device Management.
3. Tap the profile, then Install, and enter your passcode.
4. Confirm, then tap Done.
5. To check it is active, go to Settings > General > VPN & Device Management > DNS. To turn it off, return here and remove the profile.

A profile you install yourself applies on Wi-Fi and mobile data. Only install profiles from a provider you trust, because a DNS profile can see every domain your phone looks up.

Option 2: Make your own profile

Apple documents the profile format as the DNS Settings payload. The important keys are DNSProtocol (HTTPS or TLS), ServerURL for a DoH template, ServerName for a DoT hostname and an optional ServerAddresses list. A minimal DoH payload for Cloudflare looks like this, inside a standard configuration profile wrapper:

<dict>
  <key>PayloadType</key>
  <string>com.apple.dnsSettings.managed</string>
  <key>DNSSettings</key>
  <dict>
    <key>DNSProtocol</key>
    <string>HTTPS</string>
    <key>ServerURL</key>
    <string>https://cloudflare-dns.com/dns-query</string>
    <key>ServerAddresses</key>
    <array>
      <string>1.1.1.1</string>
      <string>1.0.0.1</string>
    </array>
  </dict>
</dict>

Most people should use a provider’s ready-made profile or Apple Configurator rather than writing XML by hand. Apple’s developer documentation now marks this device management payload as deprecated from iOS 27 and macOS 27 in favour of its newer declarative management system. That mainly affects companies that deploy profiles through MDM, but it is worth knowing if a profile stops installing after a future update.

Option 3: Use the 1.1.1.1 app

Cloudflare’s own setup guide for iOS recommends its free 1.1.1.1 app. It encrypts DNS on any network, but it does so by installing a VPN configuration, and by default it turns on WARP, which routes all traffic through Cloudflare. If you only want encrypted DNS, switch the app to its DNS-only mode.

You can also type a resolver into Settings > Wi-Fi > (i) > Configure DNS > Manual, but that is plain, unencrypted DNS, it only applies to that one Wi-Fi network and it does nothing on mobile data.

How to turn on DNS over HTTPS in Windows 11

Windows 11 can encrypt DNS for the whole system. Windows 10 cannot, which Microsoft states plainly in its support documentation. The option appears once you set DNS servers manually:

1. Open Settings > Network & internet.
2. Choose Wi-Fi and then your network’s properties, or Ethernet and your connection.
3. Next to DNS server assignment, select Edit. Microsoft’s guide shows the same fields under IP assignment > Edit.
4. Change Automatic (DHCP) to Manual and turn on IPv4.
5. Enter a Preferred DNS address, for example 1.1.1.1, and an Alternate DNS, for example 1.0.0.1.
6. Under DNS over HTTPS, choose On (automatic template).
7. Decide on Fallback to plaintext. Off means DNS fails rather than leaking in plain text. On means it falls back if HTTPS is unavailable.
8. Repeat for IPv6 if your connection uses it, then select Save.

The automatic template only works for resolvers Windows already knows. Windows ships with a list that includes Cloudflare, Google and Quad9, and you can view it in PowerShell. For a resolver that is not on the list, such as AdGuard or NextDNS, choose On (manual template) and paste the provider’s DoH URL. You can also add it to the list from an administrator PowerShell window:

Get-DnsClientDohServerAddress

Add-DnsClientDohServerAddress -ServerAddress 94.140.14.14 -DohTemplate "https://dns.adguard-dns.com/dns-query" -AllowFallbackToUdp $false -AutoUpgrade $true

DNS settings in Windows are per network adapter. If you use both Wi-Fi and Ethernet, set both. Companies can control the same behaviour through the Group Policy setting Configure DNS over HTTPS (DoH) name resolution, with Prohibit, Allow and Require options. Microsoft warns against using Require on domain-joined PCs, because Active Directory depends on internal DNS that is not reachable over DoH.

How to turn on encrypted DNS on a Mac

macOS also supports DoH and DoT through the same configuration profiles as the iPhone, from macOS Big Sur onwards. There is no switch in System Settings.

1. Download the profile from your DNS provider and double-click it. macOS says it needs to be reviewed in System Settings.
2. Open the Apple menu > System Settings, then go to General > Device Management. Older versions call this section Profiles.
3. Under Downloaded, double-click the profile, review it, then click Continue and Install.
4. Enter your Mac password to approve it.

To remove it later, select the profile in Device Management and click the minus button. The DNS server fields in System Settings > Network > (your connection) > Details > DNS only set plain DNS, just like the iPhone’s manual DNS option.

How to turn on secure DNS in Chrome, Edge and Firefox

Browsers can encrypt their own DNS lookups even when the operating system does not. This is the quickest fix on Windows 10 or a work laptop where you cannot change system settings. It only covers that browser, so other apps still use plain DNS.

Google Chrome

1. Open the three-dot menu and select Settings.
2. Go to Privacy and security > Security.
3. Under Advanced, turn on Use secure DNS.
4. Leave it on your current service provider, or select a provider such as Cloudflare, Google or Quad9 from the list. You can also choose a custom provider and paste a DoH URL.

Chrome’s default behaviour is to try DoH with your current resolver if it supports it, and to use plain DNS otherwise. A custom provider does not fall back, so a typo will break browsing. The setting is greyed out when Chrome is managed by an employer or school. Chrome’s other protections are worth a look while you are there, and we have covered Chrome’s Enhanced protection separately.

Microsoft Edge

1. Open the three-dot menu and select Settings.
2. Go to Privacy, search, and services and scroll to Security.
3. Turn on Use secure DNS.
4. Select Choose a service provider and pick one from the list, or paste a DoH URL.

Mozilla Firefox

1. Open the menu and select Settings.
2. Go to Privacy & Security and scroll to Enable secure DNS using.
3. Pick Increased Protection to use your chosen DoH provider with a backup if needed, or Max Protection to always use DoH and show an error rather than fall back.
4. Choose a provider from the list, or select Custom and paste a DoH URL.

Firefox’s Default Protection lets Firefox decide, and it will turn DoH off on networks that signal they do not want it. Networks do that with a special domain called a canary domain, use-application-dns.net. Corporate and parental-control networks use it to keep their filters working.

How to encrypt DNS for the whole home network

A router or local DNS server can encrypt the queries it forwards to an upstream resolver. Devices usually still send plain DNS across the home LAN, and apps with their own resolver settings may bypass it. That distinction matters if you expect every device to follow the same policy.

Whether this is possible depends on your router. Many basic routers supplied by internet providers only let you change the plain DNS servers. Gateways such as Ubiquiti’s UniFi range have DoH built in, and some other enthusiast routers offer DoH or DoT, so check the spec sheet for the exact wording. If you are buying a new router anyway, our Wi-Fi 7 router guide covers what to look for beyond raw speed.

UniFi Express and other UniFi gateways

Ubiquiti calls the feature Encrypted DNS. It was named DNS Shield in older versions of the UniFi Network application, and it uses DoH. Ubiquiti’s help centre does not have a dedicated article for it, so the labels below come from the current UniFi Network application and Ubiquiti’s community forum, and may move between versions.

1. Open the UniFi Network application, in a browser or the UniFi app, and sign in to your UniFi Express or other gateway.
2. Go to Settings > Security and open the Protection section.
3. Find Encrypted DNS. Auto uses Cloudflare with Google as backup. Predefined lets you pick from a list. Custom accepts a DNS stamp or DoH server for providers like NextDNS.
4. Apply the change.
5. Under Settings > Networks, open each network and make sure the DHCP DNS server is left on Auto, so devices send their DNS to the gateway.

Encrypted DNS on a UniFi gateway overrides the DNS servers set on the internet (WAN) connection. It only protects devices that use the gateway for DNS, so a phone with its own Private DNS hostname keeps using that instead. UniFi’s content filtering can redirect all DNS traffic to the gateway if you want to enforce one policy for the whole network.

Pi-hole with an encrypted upstream

Pi-hole is a network-wide ad blocker that acts as your home’s DNS server, often on a Raspberry Pi or an always-on PC. Our beginner’s guide to home servers covers the hardware side. Out of the box, Pi-hole forwards queries to an upstream resolver in plain text. Unbound can either resolve queries itself or forward them over TLS. Only the forwarding configuration below encrypts the upstream queries.

A note on cloudflared. Many older guides use Cloudflare’s cloudflared tool as a local DoH proxy for Pi-hole. Pi-hole’s own documentation now says Cloudflare deprecated that proxy mode in November 2025, and that it stops working if cloudflared is updated after 2 February 2026. Do not use it for a new setup.

Method 1: Unbound as a recursive resolver. This is what Pi-hole’s documentation recommends. Unbound runs on the same machine, listens on port 5335 and looks up domains itself by asking the root, top-level and authoritative servers, with DNSSEC validation. No single public resolver sees all your queries. The trade-off is that these lookups are not encrypted, because most authoritative servers do not support encryption. Your provider can still see them, but they are spread across many servers rather than handed to one company.

1. Install Unbound with sudo apt install unbound.
2. Create /etc/unbound/unbound.conf.d/pi-hole.conf using the configuration in Pi-hole’s Unbound guide, which sets port: 5335 and listens only on 127.0.0.1.
3. Restart Unbound and test it with dig pi-hole.net @127.0.0.1 -p 5335.
4. In the Pi-hole web interface, go to Settings > DNS, untick every upstream server and enter 127.0.0.1#5335 as a custom DNS server.
5. Click Save & Apply.

Method 2: Unbound forwarding over DoT. If you would rather hide queries from your provider, Unbound can forward everything to a public resolver over DNS over TLS instead of resolving it itself. Keep Pi-hole pointed at 127.0.0.1#5335 and add a forward zone like this to the same Unbound configuration file:

server:
    tls-system-cert: yes

forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 9.9.9.9@853#dns.quad9.net
    forward-addr: 149.112.112.112@853#dns.quad9.net

The part after # is the hostname Unbound checks on the resolver’s certificate, and @853 is the DoT port. tls-system-cert tells Unbound to trust the operating system’s certificate store. Older Unbound builds need tls-cert-bundle with a path to the certificate file instead. Swap in Cloudflare (1.1.1.1@853#one.one.one.one) or Google (8.8.8.8@853#dns.google) if you prefer.

Finally, point your router’s DHCP DNS setting at the Pi-hole’s IP address so every device uses it. On Debian Bullseye and later, Pi-hole’s guide also explains a fix for the unbound-resolvconf service, which can otherwise override your system’s DNS settings.

How to check that encrypted DNS is working

After changing settings, confirm that encryption is actually happening rather than assuming it.

• Cloudflare: open 1.1.1.1/help. It shows whether you are connected to 1.1.1.1 and whether DoH or DoT is in use.
• NextDNS and AdGuard: their dashboards show a live query log and a status page that confirms your device is using them, with the protocol.
• Android: if websites load with Private DNS set to a hostname, encryption is working, because strict mode cannot fall back to plain DNS.
• From a terminal: the kdig tool from the Knot DNS utilities can query a resolver over DoT, which proves the resolver and port are reachable from your network.

kdig -d @1.1.1.1 +tls-ca +tls-host=one.one.one.one example.com

A DNS leak test shows which resolver answered, but that alone does not prove the transport was encrypted. Use the provider’s protocol check or inspect DNS traffic on the device or gateway when you need to verify it.

Encrypted Client Hello: the last piece

With DNS encrypted, the biggest remaining leak is the website name in the TLS handshake. Encrypted Client Hello (ECH) encrypts that part of the handshake too, so a network sees only a generic name. It was published as RFC 9849 in March 2026 and depends on DNS to work. A site publishes its ECH key in a DNS record called the HTTPS record, defined in RFC 9460, and the browser fetches it before connecting.

That is why ECH works best with encrypted DNS. If the HTTPS record arrived in plain text, a network could simply strip it out. Major browsers, Chrome among them, already use ECH when a site offers it, and Cloudflare turns it on by default for sites on its free plan, with cloudflare-ech.com as the visible outer name. There is nothing for you to switch on beyond secure DNS in your browser, which is one more reason to enable it.

When encrypted DNS can cause problems

• Work and school networks. Companies often rely on internal DNS names and DNS-based security filtering. Encrypted DNS pointed at a public resolver can break intranet sites and may break policy. On managed devices, the settings are often locked anyway.
• Captive portals. Hotel and airport Wi-Fi login pages can fail to appear when DNS is strictly encrypted. Switch Android to Automatic or turn Windows fallback on, log in, then switch back.
• Parental controls. If your router or provider filters content through DNS, a browser using DoH bypasses it. Use the filtered versions of the resolvers above, such as Cloudflare 1.1.1.3 or AdGuard Family, on children’s devices instead.
• Blocked ports. Some networks block port 853. If DoT fails, try DoH, which uses port 443.

Which setup should you use?

For most people, two changes cover nearly everything. Set Android’s Private DNS to a hostname, or install a resolver profile on an iPhone, so its DNS lookups use encryption wherever that configuration works. Then turn on DNS over HTTPS in Windows 11 or in your browser. Add router-level or Pi-hole encryption once you want the TV, console and smart home devices covered too.

FAQ

Can my internet provider still see the sites I visit?

It may still infer sites from destination IP addresses or an unencrypted TLS server name. Encrypted DNS protects the DNS lookup; it does not hide all network activity. A VPN changes who can observe that traffic, so its privacy depends on the VPN provider too.

Why does Android reject my DNS address?

Private DNS needs a DoT hostname such as dns.google. It does not accept IP addresses or DoH URLs.

Do I need encrypted DNS if I use a VPN?

Usually not on that device. A good VPN sends your DNS through its own encrypted tunnel. Encrypted DNS is useful when the VPN is off, or on devices that cannot run one.

• SourceRFC 8484: DNS Queries over HTTPS (DoH)

• SourceRFC 7858: DNS over TLS

• SourceRFC 9250: DNS over Dedicated QUIC Connections

• SourceMicrosoft Support: Essential network settings in Windows

• SourceMicrosoft Learn: Secure DNS client over HTTPS

• SourceAndroid Developers Blog: DNS over TLS support in Android

• SourceGoogle Chrome Help: Use secure DNS

• SourceApple Developer: DNS Settings payload

• SourceCloudflare: 1.1.1.1 encryption docs

• SourceQuad9: Service addresses and features

• SourceAdGuard DNS: Public DNS

• SourcePi-hole: unbound guide

• SourceGoogle: DNS over HTTP/3 in Android

• SourceMozilla: DNS over HTTPS protection levels