When you enter a web address, your device first uses DNS to ask which IP address corresponds to the domain name. Because traditional DNS queries can travel unencrypted on many networks, attackers on the same Wi-Fi network or the network operator may learn which domains you are trying to visit and, under some circumstances, interfere with the response. DNS over HTTPS (DoH) and DNS over TLS (DoT) carry these queries and responses between your device and the DNS resolver through an encrypted channel.
Encrypted DNS is a useful layer of security and privacy; it is not a VPN or a tool for complete anonymity. Your chosen DNS provider can see the queries, the destination server can still see your IP address, and metadata such as traffic size and timing does not disappear entirely. The first step in setup is to accept these limitations and determine which problem you want to solve.
The practical difference between DoH and DoT
DoH carries DNS traffic over HTTPS and is commonly available through browsers’ “Secure DNS” setting. When enabled only in a browser, it may protect that browser’s queries, while games, email apps, and other software may continue to use the operating system’s DNS settings. DoT, by contrast, uses a separate TLS connection. On compatible versions, Android’s “Private DNS” option can be used across the device by entering a DoT provider hostname.
Do not choose one method over the other simply because it is “newer.” Browser-level DoH is convenient for someone who wants to use a consistent resolver across different networks. An operating-system- or router-level solution may cover a wider range of applications. On corporate devices, in homes with parental controls, on school networks, or in workplaces that use local domain names, consult the support team before changing administrator policies.
Read the privacy policy when choosing a provider
Not all free DNS services have the same logging policy, filtering approach, or security model. Find out whether the provider retains query logs, how long it stores IP addresses, in which country it processes data, and whether it uses the information for advertising profiles. Evaluate features such as DNSSEC validation, malicious-domain filtering, and child filters separately. If you use a “Family” profile, the deliberate blocking of certain sites is not a malfunction.
Changing your DNS resolver will not magically speed up your internet connection. A nearby, well-operated resolver may reduce latency, but caching, network routing, and the performance of the sites you visit all affect the result. Base your decision on repeated query and page-load measurements at different times rather than a single speed test.
Setting up Secure DNS in Firefox
Find the DNS over HTTPS options in the privacy and security section of Settings. Protection levels may behave differently: more flexible modes may fall back to system DNS when a network problem occurs, while the strictest mode may stop the connection and ask the user to decide. If privacy is a high priority, you may not want a configuration that silently falls back to unencrypted DNS. On the other hand, you may temporarily need the network’s DNS behavior to access a hotel or airport sign-in page.
If you select a custom provider, use only the DoH endpoint given in its official documentation. Do not paste in addresses copied at random from search results. After saving the setting, restart the browser and test both on your normal connection and with your VPN enabled. If the VPN enforces its own DNS resolver, the browser and system settings may behave differently than you expect.
Setting up Private DNS on Android
On modern Android versions, open “Private DNS” under the network and internet settings. The provider hostname option expects a valid server name for DoT, not an IP address. Enter the exact name shown on the provider’s official setup page. After saving it, connect separately over Wi-Fi and mobile data; some networks may block DoT connections.
If you receive a “Private DNS server cannot be accessed” warning, do not simply turn off the setting and forget about it. Check for typing errors, verify the date and time, and inspect your VPN or security app and the network’s captive portal. You may temporarily need the automatic setting to sign in to a hotel network; re-enable Private DNS after completing the sign-in. If a site does not open under a filtered profile, first review the provider’s blocking log or test page.
What gap does ECH fill?
Although HTTPS encrypts page content, the destination server name could historically be visible in plain text in the ClientHello message at the start of a TLS connection. Encrypted Client Hello (ECH) aims to encrypt this part on browsers and servers that support it. DoH or DoT protects the DNS query, while ECH protects part of the TLS handshake; they are not substitutes for one another.
ECH depends on end-to-end support. The browser, DNS resolver, and visited service must support the required records and protocol. A result from a single unsupported site therefore may not mean that your overall configuration is broken. ECH also does not hide the destination IP address, the amount of traffic passing through your internet service provider, or the account you are signed into in the browser.
Verify the setup with four separate tests
First, use the provider’s official test page to check whether the device is using the expected resolver. Second, run a DNS leak test separately on your normal connection and with the VPN enabled. Seeing multiple resolvers in the result does not always indicate a leak; the provider’s distributed infrastructure may display different server names. If you see DNS servers belonging to an internet service provider you did not expect, review the scope of the browser and operating-system settings.
The third test concerns connection resilience. Switch from Wi-Fi to mobile data, put the phone to sleep and wake it again, and try resolving domain names in several apps. The fourth test concerns local services: if a printer, modem administration page, or internal company domain does not open, the encrypted resolver may not know the local names. Instead of disabling security completely, use a documented exception for that network or the organization’s trusted resolver.
Do not forget about the configuration forever just because a test site reported it as “secure.” Test it again after browser and operating-system updates, a VPN change, or the installation of a new router. Review your chosen provider’s privacy policy at least once a year. This allows you to use encrypted DNS not as an exaggerated promise of anonymity, but as a network-security layer whose scope is understood and whose operation is regularly verified.