Every site you open starts with a question: where does this name live? That question is DNS, the internet’s phonebook. On a normal connection it goes out in the clear, so the network you are on can read it, log it, and rewrite it. Encrypted DNS seals that question. It does not hide which computer you then connect to, and it does not hide the question from the resolver you chose.
Short version
- Plain DNS is a postcard. Your provider, the cafe Wi-Fi, and anyone on the path can read the names.
- DoH, DoT, and DoQ seal the postcard. Android’s Private DNS setting is DoT, not DoH. A network can block DoT’s port and leave ordinary web traffic alone. [2] [5]
- The resolver you pick still sees every name. You moved the list. You did not burn it.
- After the lookup, the IP address you connect to can still name the site. Encrypted Client Hello hides the name inside the next handshake. Russia answered Cloudflare’s version of that by blocking thousands of sites. [7]
What the postcard actually says
DNS was built when the people on the wire were universities, not advertisers and interior ministries. Lookups went out as readable text. The encrypted fix for the common case, DNS over HTTPS, was published as RFC 8484 in October 2018. The document says the point is to stop on-path interference and passive surveillance. [1]
There are three seals, and they are not the same to a network admin:
- DNS over TLS (DoT) uses its own port, 853. Android’s Private DNS hostname is this. Easy to spot, easy to block, while the rest of the web still works. [2] [5]
- DNS over HTTPS (DoH) hides the lookup inside ordinary web encryption on port 443. Harder to single out. Browsers use this. RFC 8484. [1]
- DNS over QUIC (DoQ) does the same job on the newer QUIC transport. RFC 9250. Fewer menus expose it. [3]
A resolver that wants to be less nosy can also ask upstream servers only the piece of the name it needs. That is QNAME minimization, RFC 9156. It does not hide the name from your chosen resolver. It stops every server along the chain from learning the full question. [4]
What encryption does not hide
The resolver still has the list. Handing the postcard from your internet provider to another company only changes who reads it. Quad9’s own writeup says it drops your IP at the edge and does not keep a query log tied to you. It does keep rough geography, and it sends stripped telemetry about blocked names, with no form of your IP attached. Read that as “not a dossier,” not as “they see nothing.” [8]
The next packet still has an address. Encrypted DNS hides the name from the cafe and the ISP. You then connect to an IP. If that site has its own address, the IP is the name. A big shared host makes this fuzzier. The name also used to sit in the clear in the TLS handshake, the SNI field. Encrypted Client Hello hides that name. Cloudflare turned its version on by default in 2024. On November 8, 2024, The Record reported that Russia’s regulator, Roskomnadzor, had blocked thousands of sites using it, and told Russian site owners to get off Cloudflare. The feature worked well enough that a censor treated it as a bypass. [7]
One honest resolver can become the new sorting office. If a country, a browser, or a school sends everyone to the same encrypted resolver, a single order replaces a thousand ISP taps. Oblivious DoH, RFC 9230, splits the job: a proxy sees your IP and not the name, the resolver sees the name and not your IP. Apple and Cloudflare have shipped versions of this idea. It fails if both halves are the same company, or if the proxy and the resolver compare notes. [6]
The log outlives the law that collected it. Health sites, debt sites, a newsroom your government later decides is a problem. Encrypted DNS does not delete yesterday’s postcard. It stops tomorrow’s from being readable on the wire.
Who to hand the list to
| Resolver | Who | The catch |
|---|---|---|
| Quad9 [8] | Swiss nonprofit. Malware and phishing names blocked. DoT hostname dns.quad9.net. |
The default for most people. Blocking is a choice. A false block is their list, not yours. |
| DNS4EU [9] | EU-backed public resolver, with optional threat and ad blocking, encrypted. | Newer. Good if you want the operator in Europe. (dns0.eu, the earlier EU option, shut down in October 2025.) |
| Control D [10] | Canadian company. Filters you configure. Encrypted. | A company, not a foundation. Read what they log before you pay. |
| AdGuard DNS [11] | Commercial. Ads and trackers, optional adult filter. | Convenient, and you are inside a vendor’s product. |
| NextDNS [12] | US company. Logging off unless you turn it on. Per-device lists. | Free tier caps queries. The config profile is the easy iPhone path. |
| Cloudflare 1.1.1.1 [13] | US company. DoT hostname one.one.one.one. Fast. Little filtering unless you pick the family names. |
Huge. A privacy policy is not the same as a small foundation. Concentration risk, above. |
| Pi-hole or AdGuard Home [14] [15] | You, on a spare box, for the whole house. | The box still asks someone upstream. Point it at Quad9 or DNS4EU, or you rebuilt the postcard. |
Skip Mullvad’s public DNS. They are shutting those servers on November 2, 2026 and telling people to use Quad9. Mullvad VPN’s own tunnel DNS is a different thing and keeps working. Old iPhone profiles for the public servers will die on that date. [16]
Ten minutes, if you do it on purpose
- Android 9 and later: Settings, Network and internet, Private DNS, then the provider hostname. For Quad9 that is
dns.quad9.net. This is DoT. “Automatic” only encrypts if the network’s own DNS supports it. Pick the hostname. [5] - iPhone: there is still no plain switch in Settings. Install the provider’s configuration profile, or their app. NextDNS and Quad9 both publish profiles.
- Windows 11: Settings, Network and internet, your adapter, DNS server assignment, Edit, Encrypted. Use the provider’s template, not a random IP you found in a forum.
- The house: the router, or Pi-hole / AdGuard Home, or the TV and the console keep using the provider.
- Check: dnscheck.tools should name the resolver you picked, not the ISP. [17]
Seal the postcard. Then remember who you handed it to, and that the address on the next packet can still give you away.
Sources
- [1] IETF, Oct. 2018: RFC 8484, DNS over HTTPS
- [2] IETF, May 2016: RFC 7858, DNS over TLS
- [3] IETF, May 2022: RFC 9250, DNS over QUIC
- [4] IETF, Nov. 2021: RFC 9156, QNAME minimization
- [5] Google: Private DNS on Android, and Cloudflare’s note that this setting is DNS over TLS
- [6] IETF, June 2022: RFC 9230, Oblivious DNS over HTTPS
- [7] The Record, Nov. 8, 2024: Russia blocks sites using Cloudflare’s Encrypted Client Hello
- [8] Quad9, Feb. 2025: how Quad9 handles your data
- [9] DNS4EU: EU-backed public resolver
- [10] Control D: configurable encrypted DNS
- [11] AdGuard DNS: public encrypted DNS with filtering
- [12] NextDNS: per-device filtering
- [13] Cloudflare: 1.1.1.1 public resolver privacy
- [14] Pi-hole: network-wide blocking you run
- [15] AdGuard Home: self-hosted DNS
- [16] Mullvad, Sept. 3, 2026: public DNS shuts on November 2, 2026
- [17] dnscheck.tools: see who actually answers
