How DNS Exposes Your Browsing
Every time you visit a website, your device sends a DNS query to translate the domain name into an IP address. By default, these queries travel over UDP port 53 in plaintext. This means your ISP, network administrator, or anyone monitoring your connection can read every domain name you request.
Here is the scale of the exposure. The average person makes hundreds of DNS queries per day. Each one reveals the exact domain you want to visit — google.com, bankofamerica.com, any medical site, any news article. Even though the content of the website is encrypted by HTTPS, the domain name in the DNS request is not. Your ISP can log every single one.
In many countries, ISPs are legally required to retain DNS logs for months or years. Even without legal requirements, ISPs routinely log this data for their own purposes. The DNS query is the most revealing unencrypted signal in your browsing activity. Fixing this is simple and free. See our complete DNS guide for more background.
What DNS-over-HTTPS Does
DNS-over-HTTPS (DoH) encrypts your DNS queries by sending them inside an HTTPS connection — the same encryption that protects online banking and shopping. Instead of sending a plaintext UDP packet to port 53, your device sends an encrypted HTTPS request to port 443.
The result: your ISP sees that you are making an HTTPS connection to a DNS provider (like Cloudflare or Google), but it cannot read the contents of that connection. The specific domain you are looking up is hidden inside the encrypted tunnel. Your ISP knows you are doing *something* on port 443, but it cannot tell that you just looked up cnn.com.
DoH is supported natively in Firefox, Chrome, Edge, Safari, and all major browsers. It is also available at the operating system level on Windows, macOS, Linux, Android, and iOS. For setup details, see our DoH complete guide.
What DNS-over-TLS Does
DNS-over-TLS (DoT) encrypts DNS queries using TLS — the same protocol that secures HTTPS websites. Unlike DoH, DoT uses its own dedicated port (853) rather than sharing port 443 with other HTTPS traffic.
DoT wraps the entire DNS query in a TLS tunnel. Your ISP can see that you are connecting to port 853, which signals encrypted DNS, but cannot read the content of the query itself. The domain names you look up remain hidden.
DoT is the preferred choice for enterprise environments because network administrators can manage encrypted DNS traffic on its own port. It is also the default encrypted DNS protocol on Android 9+ (called "Private DNS"). iOS, macOS, and Windows also support DoT natively. For more details, see our DoT complete guide.
DoH vs DoT Comparison
Both protocols provide the same level of encryption (TLS 1.3). The difference is in how they transmit and what that means for different use cases.
| Feature |
DoH |
DoT |
| Port |
443 (HTTPS) |
853 (dedicated) |
| Encryption |
TLS 1.3 |
TLS 1.3 |
| Blocks bypass attempts |
Hard to block |
Easier to block |
| Enterprise manageability |
Low |
High |
| Browser support |
All major browsers |
OS-level only |
| Best for |
Personal privacy |
Enterprise / Android |
For most personal users, DoH is the simpler choice because it works at the browser level without any OS configuration. For Android users, Private DNS (DoT) is already built in. For enterprise networks, DoT gives administrators more control. Either way, both protect your DNS queries from ISP surveillance. Learn more in our best DNS for privacy guide.
How to Enable Encrypted DNS
Enabling encrypted DNS takes under two minutes on any device. Here is the fastest method for each platform.
Firefox (Browser-Level DoH)
Open Settings, scroll to Network Settings, click Settings, scroll to DNS over HTTPS, select "Increased Protection," and choose Cloudflare or NextDNS. Click OK. Firefox will now encrypt all DNS queries made through the browser. This works regardless of your operating system DNS settings.
Chrome (Browser-Level DoH)
Open Settings, go to Privacy and Security, click Security, scroll to Use secure DNS, toggle it on, and select a provider or enter a custom DoH URL like https://1.1.1.1/dns-query. Chrome will encrypt DNS queries. See our DoH setup guide.
Android (Private DNS / DoT)
Open Settings, go to Network and Internet, tap Private DNS, select "Private DNS provider hostname," and enter 1dot1dot1dot1.cloudflare-dns.com. Tap Save. This enables DNS-over-TLS for all apps on your device. Android 9 and above support this natively. See our Android Private DNS guide.
Windows 11 (DoH)
Open Settings, go to Network and Internet, click your connection (Wi-Fi or Ethernet), click Properties, click "Edit" under DNS settings, change to Manual, toggle IPv4 on, enter 1.1.1.1 as preferred DNS, set the preferred encryption to "Encrypted only (DNS over HTTPS)," enter 1.0.0.1 as alternate, and set its encryption too. Click Save.
macOS (DoT)
Open System Settings, go to Network, select your connection, click Details, go to DNS, add 1.1.1.1 and 1.0.0.1, then go to the DNS Over TLS tab (available on macOS 14+) and enable it. For older macOS, use the Cloudflare desktop app or configure at the router level.
Router-Level (All Devices)
Many modern routers (ASUS, Linksys, Netgear) now support encrypted DNS natively in their firmware. Access your router admin page, find the DNS settings under WAN or Internet, and look for DoH or DoT options. Enter https://1.1.1.1/dns-query for DoH or 1dot1dot1dot1.cloudflare-dns.com for DoT. This encrypts DNS for every device on your network. See our complete DNS guide for router-specific instructions.
After enabling encrypted DNS, run our DNS leak test to verify your queries are no longer going to your ISP's DNS server.
Frequently Asked Questions
Can my ISP really see every website I visit?
Yes, by default your ISP can see every DNS query your device sends. When you type a website address, your device sends a DNS request to resolve the domain name to an IP address. These queries are typically sent in plaintext over UDP port 53, which means your ISP can log every domain you visit. Even if you use HTTPS for the website itself, the initial DNS lookup reveals the domain name to your ISP.
Does DNS-over-HTTPS fully prevent ISP tracking?
DNS-over-HTTPS encrypts your DNS queries so your ISP cannot read them. However, your ISP can still see that you are connecting to a DNS provider's IP address via HTTPS. A sophisticated ISP could infer you are using encrypted DNS. For complete browsing privacy, combine DoH with a VPN. DoH prevents ISP DNS logging, which is the most common form of browsing surveillance.
Is DoH or DoT better for privacy?
Both provide equivalent encryption. DoH runs on port 443, blending with normal HTTPS traffic, making it harder for network administrators to block. DoT runs on port 853 and is a dedicated encrypted DNS protocol. DoH is better for bypassing restrictive networks and firewalls. DoT is better for enterprise environments where administrators want to manage DNS traffic separately. For home users, either works well for privacy.
Does changing DNS to a private provider actually improve privacy?
Yes. Your ISP's DNS server is the first place your browsing activity is logged. By switching to a privacy-focused DNS provider like Cloudflare (1.1.1.1) or Quad9 (9.9.9.9) and enabling encrypted DNS (DoH or DoT), you prevent your ISP from logging your DNS queries. Cloudflare commits to purging logs within 24 hours and publishes audits. Quad9 does not log IP addresses. Neither sells your data. This is a meaningful privacy improvement for no cost.
Test Your DNS Speed
After enabling encrypted DNS, run our free DNS leak test to verify your queries are protected.
Run DNS Speed Test
Want to learn more? Read our complete DNS guide, compare DNS-over-HTTPS and DNS-over-TLS, or find the best DNS for privacy.