Encrypted DNS protects the lookup transport between a client and its chosen resolver. DNS over HTTPS uses HTTPS; DNS over TLS uses a TLS connection for DNS. Both shift trust to the resolver and neither hides every aspect of your Internet traffic.
What DoH and DoT encrypt
Traditional unencrypted DNS can expose queries on the path to the resolver. DoH and DoT encrypt that leg. The recursive resolver still processes the queried names, and encryption does not guarantee that it uses a particular logging policy.
| Method | Transport | Practical consideration |
|---|---|---|
| DoH | DNS carried over HTTPS | A browser may configure it separately from the OS |
| DoT | DNS carried over TLS, commonly port 853 | A distinct transport can be managed at the network boundary |
Encrypted DNS does not encrypt the web connection itself. HTTPS handles that separately. Other traffic metadata can remain observable, and using an encrypted resolver does not turn a device into an anonymous client.
Choose a resolver intentionally
Review the operator's privacy policy, availability, filtering behavior, and support for the environments you use. A family-filtering resolver, a workplace resolver, and an ordinary public resolver can deliberately return different answers. A fast DNS response is useful, but it does not increase the capacity of an already established file transfer.
Prefer a documented system or router configuration when consistency across applications matters. A browser override may be appropriate for an individual user, but record that override so later command-line comparisons make sense.
Why local names or VPN resources break
Consider a workplace VPN that resolves an internal hostname through a company DNS server. If a browser instead sends the name to a public DoH resolver, that resolver may have no knowledge of the internal zone. The browser fails while another application works. The fix is to align resolution with the intended VPN or enterprise policy, not to publish the internal name publicly.
- Compare a browser lookup with the OS or command-line resolver.
- Check browser encrypted-DNS settings and the VPN's DNS configuration.
- Test an ordinary public hostname and an internal hostname separately.
- Apply the administrator's supported split-DNS policy on managed networks.
Keep the security boundaries clear
DoH and DoT protect transport; DNSSEC validates signed DNS data through a different mechanism. One does not automatically imply the other. A resolver can also block a domain without judging every page or downloaded file hosted there.
If enabling encrypted DNS bypasses a local filter you intended to keep, decide where that policy should live and configure the supported solution. Avoid random resolver changes during an outage: preserve the old settings, change one layer, and record whether the failing hostname now resolves and connects.
Put it into practice
References & further reading
Protocol standards and official documentation supporting this guide. Device menus and provider policies vary; use the documentation for your equipment when applying a change.