>DNS Encryption in 2026:Practical Guide to DoH, DoT, DoQ and Private DNS

Introduction

DNS encryption protects the lookups your device makes before it connects anywhere. On a plain connection, each lookup and its answer cross the network as readable text on port 53, so the Wi-Fi operator or your internet provider can log every name you look up and even answer with a different address. Encrypted DNS sends the same question inside TLS or QUIC, where the path can no longer read or change it.

Three standards do this: DNS over TLS (DoT), DNS over HTTPS (DoH) and DNS over QUIC (DoQ). DoH3 is ordinary DoH carried over HTTP/3. In 2026 every major system and browser supports at least one, often in an automatic mode that falls back to plain DNS without telling you.

---

What Is DNS Encryption? DoH, DoT and DoQ in One Paragraph

DNS encryption, also called encrypted DNS, puts the lookups between your device and its resolver (the server that finds addresses for you) inside an encrypted connection. The DNS messages themselves are unchanged: DoT carries them over TLS on a port of its own, DoH hides them inside ordinary HTTPS, and DoQ uses QUIC, the transport behind HTTP/3. The protection covers this one hop, and the resolver at the other end still reads every name you look up.

---

Why DNS Still Matters

HTTPS encrypts the page, but the lookup before it names the site, and a log of lookups reads like a browsing history. Plain DNS is also easy to tamper with: unless the domain is signed with DNSSEC and the resolver checks it, any network on the path can rewrite answers. That is how DNS hijacking, name-based blocking and tracking work.

DNS now carries more than addresses. HTTPS records (RFC 9460) deliver the key that Encrypted Client Hello uses to hide the site name in the TLS handshake. If those records travel in plain text, someone on the path can strip them and switch that protection off.

---

The Core Transports: DoUDP, DoT, DoH and DoQ

All of these carry the same DNS messages. They differ in the wrapper, the port, and how easily a network can spot them.

DoH vs DoT (DNS over HTTPS vs DNS over TLS)

Both encrypt with TLS and verify the resolver, so on the wire they protect you about equally. DoT's dedicated port tells a network that you use encrypted DNS and lets it block you with one firewall rule; your device then falls back to plain DNS or stops resolving. DoH on port 443 can share a connection with other HTTPS traffic, which RFC 8484 says makes interference and traffic analysis harder, though known DoH resolvers can still be blocked by address. In exchange, HTTP adds its own ways to link requests, such as cookies and header patterns, as RFC 8484 also notes. In practice DoT serves Android Private DNS and systemd-resolved on Linux, DoH serves browsers and Windows, and Apple platforms support both.

DoH vs DoH3 vs DoQ

DoH3 is ordinary DoH over HTTP/3, on UDP port 443. DoQ is a separate protocol that maps DNS directly onto QUIC streams on UDP port 853, with no HTTP. RFC 9250 defines DoQ for every DNS hop, notes that mapping DNS straight onto QUIC suits resolver-to-authoritative traffic and zone transfers best, and lists evading middlebox blocking as an explicit non-goal.

Both fix DoT's main weakness. A TCP stream delivers answers in order, so one slow lookup holds up the rest; QUIC gives each query its own stream and resumes quickly after a network change. That is why Android, through a Google Play system update for Android 11 and later, uses DoH3 instead of DoT for well-known resolvers that support it, Google and Cloudflare at launch. QUIC can also carry a connection from Wi-Fi to mobile data, a feature often listed as a DoQ advantage, yet RFC 9250 tells DoQ clients to open a new session by default, because a migrated connection lets the resolver follow you between networks.

DoH3 blends in with web traffic; DoQ needs UDP port 853 to be open. Cloudflare documents DoH, DoT and Oblivious DoH for 1.1.1.1, while AdGuard DNS and Control D also list DoQ.

---

DNS Privacy: How Encryption Protects You and Its Limits

In strict mode, where the device checks the resolver's identity, encrypted DNS stops both passive reading and active redirection to a rogue resolver. An automatic or opportunistic mode reliably stops only passive reading: RFC 8310 says its result can be encrypted and authenticated, encrypted only, or plain text, depending on the network.

Several things stay visible:

• The resolver sees everything. Encryption moves trust from the network to the resolver operator, whose logging policy matters more than the transport. Onward lookups from the resolver to each domain's name servers mostly travel in plain text, which RFC 9539 (2024) has only started to address.
• Destination IP addresses stay in the open, because your device connects to them after the lookup. On a CDN one address serves many sites, but it still narrows things down.
• Without Encrypted Client Hello, the site name travels in plain text in the TLS handshake, in the Server Name Indication. The dependency also runs the other way: RFC 9849, the ECH standard, says ECH needs encrypted DNS to be effective, because its key arrives through DNS. The Encrypted Client Hello guide covers that layer, and TLS fingerprinting shows what else the handshake reveals.
• Some resolvers pass part of your IP address on to the name servers of the sites you visit, through EDNS Client Subnet (ECS, RFC 7871). Google Public DNS sends it, Cloudflare's 1.1.1.1 does not, and Quad9 sends it only from 9.9.9.11.

To hide where you connect as well as what you look up, pair encrypted DNS with ECH, a VPN or Tor.

---

OS and Browser Support: How to Encrypt DNS and Use Private DNS

The names differ (Private DNS, Secure DNS, DNS over HTTPS, encrypted DNS), but every platform asks the same two things: which resolver, and whether a failure falls back to plain DNS or stops.

Android Private DNS (System-level)

Private DNS is Android's system-wide setting for encrypted DNS, built on DNS over TLS. It arrived in Android 9 with three options: Off, Automatic and a provider hostname. Automatic, the default, switches to DoT only when the network's own resolver supports it and otherwise stays on plain DNS. A hostname such as dns.google is the strict mode: every query goes to that provider encrypted, and if it cannot be reached, Android marks the network as having no internet access instead of falling back.

iOS / iPadOS

Apple added DoT and DoH in iOS 14, iPadOS 14 and macOS 11 Big Sur. It is turned on through an app built on Apple's DNS settings interface or through a configuration profile, and applies to every app. Since iOS 16 and macOS Ventura, devices also upgrade on their own through Discovery of Designated Resolvers (DDR, RFC 9462): the device asks the network's resolver for _dns.resolver.arpa, and switches if the answer points to an encrypted server whose certificate contains the original resolver's IP address. The check cannot pass for a private address such as a home router, so DDR mainly helps where the network hands out a provider's public resolver.

Windows 11, macOS and Linux

Windows 11 has a built-in DoH client; Windows 10 does not. A network adapter's DNS settings can use an automatic template for resolvers Windows knows, such as Cloudflare, Google and Quad9, or one you enter. A separate fallback-to-plaintext switch decides whether a failed query goes out unencrypted or not at all, and Microsoft notes that the fallback happens without any notification. macOS follows the Apple model above. On Linux with systemd-resolved, the DNSOverTLS option enables DoT, either required or opportunistic.

Browsers

Chrome added Secure DNS in version 83 on desktop and 85 on Android. Its automatic mode upgrades you to your current provider's DoH service if Chrome knows one, and falls back to regular DNS on errors. Choosing a specific or custom provider turns fallback off. On managed devices Chrome sends no DoH unless an administrator sets the DnsOverHttpsMode policy, which Edge supports too.

Firefox desktop enables DoH by default in some regions, starting with the United States in 2020 and later Canada. Default Protection falls back on problems and steps aside when a VPN, parental controls or enterprise policies are active, or when the network answers the canary domain use-application-dns.net negatively. Increased Protection uses your chosen provider and falls back only when that provider has problems. Max Protection never falls back and shows a warning page instead. Firefox for Android added these settings in version 143.

Safari follows the system setting. A browser's own DoH covers only that browser, so to encrypt all DNS requests on a device, set encrypted DNS at the system level.

---

How to Test DNS Encryption and Leaks

No website can run a full DNS encryption test from the outside, because it cannot see whether your lookups were encrypted. Encryption covers the hop from your device to your resolver, and a site's name servers only ever talk to the resolver. What a site can see is which resolver that is, and that is what the DNS Privacy card of the Privacy & Trust Index checks.

The card has your browser look up a batch of one-off names that only packet.guru's own DNS server can answer, and every resolver that asks on your behalf has to go to that server. The card compares each resolver's network with your connection and reports the worst result: one leaking fallback resolver cannot hide behind clean ones.

Behind a VPN, a resolver in the tunnel's own network or on hosting infrastructure is not a leak; the card shows it as No DNS leak or Tunneled DNS. The causes and fixes of a real leak are in the DNS leak guide. The ECH Status card reads this result too: if ECH hid a site name but your resolver is exposed, it reports that your DNS is still open.

To confirm the encryption itself, ask the resolver, which sees how your query arrived; Cloudflare's 1.1.1.1 help page reports whether you use DoH or DoT. A strict mode is also a test, because a broken encrypted path then fails visibly. To spot tampering, compare answers with the DNS Lookup tool, which queries with dig from packet.guru's server outside your network. If a name resolves on your device to a search or block page, something on your path rewrites answers. The ECH check shows whether a site publishes an ECH key.

---

Choosing a Resolver: Privacy, Speed, and Filtering

The best DNS for privacy is the one whose operator you trust with every name you look up. Compare logging, ECS, DNSSEC validation, filtering and supported transports.

Top Public Resolvers

This private DNS list is a starting point. A self-hosted recursive resolver gives full control, but it queries each domain's name servers from your own IP, mostly in plain text, unless it forwards upstream over an encrypted transport.

---

Preventing DNS Hijacking and Improving Resilience

Encryption stops hijacking only when the device verifies whom it talks to. In RFC 8310's terms, a strict profile defends against passive and active attacks, and an opportunistic one at best against passive monitoring. So use a strict or no-fallback mode with a named resolver that validates DNSSEC: encryption protects the hop to the resolver, and DNSSEC proves the answer came from the domain's own zone.

---

Enterprise Reality: Privacy vs Visibility

Encrypted DNS removes the plain-text query log many security tools relied on, so vendors added controls: the DnsOverHttpsMode policy in Chrome and Edge, enterprise policies and the canary domain in Firefox. Windows has a Group Policy with Allow, Prohibit and Require options. Microsoft advises against Require on domain-joined machines, because Active Directory depends on DNS. The Windows Server DNS service answers DoH only on Windows Server 2025 with the June 2026 update, and only after an administrator turns it on. A network can also advertise its own encrypted resolver through DDR (RFC 9462) or DHCP and router advertisement options (DNR, RFC 9463), so devices encrypt without leaving the organization's filtering.

---

Secure DNS Filtering: Trade-offs and Options

Filtering works the same over encrypted transports, because the resolver still decides what to answer; Chrome's same-provider upgrade exists partly to keep a provider's family filtering working. A filtering resolver must see every name, so check its log retention, and it only covers apps that use it: a browser with its own DoH goes around it.

---

Practical Checklist: How to Secure DNS Today

• Set a resolver at the system level, then check the browser's own secure DNS setting.
• Once it works, choose a strict or no-fallback mode so failures show instead of dropping to port 53.
• Rerun the DNS Privacy card after changing network, VPN or resolver.
• Prefer a resolver that validates DNSSEC and, if privacy outranks CDN locality, skips ECS.
• Pair encrypted DNS with ECH, and add a VPN or Tor to hide destinations.

---

FAQ

Q: Does encrypted DNS hide my browsing history from my ISP, or do I still need a VPN?

A: Only partly. Your ISP can no longer read the names you look up, but it still sees the IP addresses you connect to and, without ECH, the site name in each TLS handshake. Your resolver sees the names instead. A VPN hides both the names and the destinations from your provider and gives that view to the VPN operator.

Q: DoH vs DoT vs DoQ: which should I use?

A: Whichever your device supports in a strict mode; all three encrypt with TLS. DoH is hardest to single out because it shares port 443 with web traffic. DoT is what Android Private DNS uses for most providers. DoQ needs UDP port 853 open.

Q: Is DoH3 the same as DoQ?

A: No. DoH3 is DNS over HTTPS sent over HTTP/3 on UDP port 443. DoQ carries DNS directly over QUIC on UDP port 853, without HTTP. Both avoid DoT's head-of-line blocking.

Q: Is encrypted DNS slower than regular DNS?

A: Barely, and mostly on the first lookup. Opening the encrypted connection costs one or two extra round trips, and after that the connection is reused. DoH and DoT perform about the same, while DoH3 and DoQ recover faster after a network change. For latency, the distance to the resolver usually matters more than the protocol.

Q: Can a website tell whether my DNS is encrypted?

A: No. A site's name servers talk only to your resolver, never to your device. A test can identify your resolver and spot leaks, but only the resolver or your settings can confirm encryption.

Q: Can Private DNS break public Wi-Fi logins?

A: It can. Captive portals often intercept DNS to show their sign-in page, and a device that insists on an outside resolver may never reach it. Sign in with Private DNS on Automatic, then switch back.

Q: Why does my phone say "Private DNS server cannot be accessed" or that a network is blocking encrypted DNS traffic?

A: Usually something on the network blocks or intercepts encrypted DNS. Android shows the first message when it cannot reach the provider hostname set in Private DNS, which also happens when the hostname is mistyped or the provider is down. iPhone, iPad and Mac show the second as a privacy warning on that Wi-Fi network. Check the hostname, or switch Private DNS to Automatic on that network.

Q: Can my router encrypt DNS for every device, including a smart TV?

A: Only if its firmware supports it. Routers from internet providers usually pass lookups in plain text to the provider's resolver. The DNS address in the router settings says nothing about encryption either: that resolver can be reached encrypted only if its operator offers DoH or DoT. A router that forwards over DoT or DoH (OpenWrt and some third-party firmware can) covers every device on the network, including smart TVs and consoles that rarely have a setting of their own. Otherwise, turn on encrypted DNS on each phone and computer.

Q: Why does my VPN provide its own DNS?

A: To keep lookups inside the tunnel. If your device still asks your provider's resolver, your provider sees every name you visit: a DNS leak.

---

Sources

• RFC 7858: DNS over TLS, RFC 8484: DNS Queries over HTTPS and RFC 9250: DNS over Dedicated QUIC Connections, IETF.
• RFC 9462: Discovery of Designated Resolvers, IETF, November 2023.
• DNS-over-HTTP/3 in Android, Google Online Security Blog.
• A safer and more private browsing experience with Secure DNS, Chromium Blog.

---