# What is encrypted DNS, what does encrypted DNS traffic mean, and which encrypted DNS server should you use? URL: https://webvpn.org/encryption/encrypted-dns/ Updated: 2026-09-13 What encrypted DNS means, how DNS over HTTPS and DNS over TLS protect lookups, and how encrypted DNS servers such as Quad9, NextDNS, AdGuard and Cloudflare differ. Encrypted DNS means the lookups your device performs to translate domain names into IP addresses are sent inside an encrypted connection, using DNS over HTTPS or DNS over TLS, so that your local network, your ISP and anyone between you and the resolver cannot read or tamper with which sites you look up. Encrypted DNS traffic is that stream of protected queries. An encrypted DNS server is a resolver that accepts those protocols, such as Quad9, NextDNS, AdGuard DNS or Cloudflare, and choosing one comes down to filtering, logging policy, jurisdiction and whether you want configurable blocking. DNS is the oldest and most overlooked leak in everyday internet use, and encrypting it has become simple enough that every major operating system and browser supports it. This guide explains what plain DNS reveals, how encrypted DNS works and what its two protocols are, what it does and does not protect, how the main encrypted DNS servers compare, and how it fits with the rest of your privacy setup. ## What plain DNS reveals Before your browser connects to a website, it asks a DNS resolver for the site's IP address. By default the query goes in plain text over UDP port 53 to the resolver your network assigned, usually your ISP's. Everyone on the path can read it: the coffee shop router, the ISP, and any network device in between. The resolver's operator sees every domain you look up, timestamped and tied to your IP address. Because HTTPS now hides the content of your web traffic, DNS lookups have become one of the richest remaining sources of browsing data for networks and ISPs, and some ISPs have used them for analytics and for redirecting mistyped domains to advertising pages. Plain DNS can also be manipulated. A network can answer queries falsely to block sites, redirect users or serve captive portals, and an attacker on a shared network can do the same. ## How encrypted DNS works Encrypted DNS wraps the same queries in a protocol that authenticates the resolver and encrypts the exchange. DNS over TLS, DoT, runs DNS inside a TLS connection on port 853. It is a clean, dedicated protocol, easy for network administrators to identify and manage, and supported natively by Android and by many routers and resolvers. DNS over HTTPS, DoH, sends DNS queries as HTTPS requests on port 443, the same port as ordinary web traffic. It is supported by all major browsers, Windows 11, macOS, iOS and Android, and is harder for networks to distinguish from web browsing. The DNS over HTTPS guide on this site covers it in depth and compares the two. In both cases, your device establishes an encrypted connection to a resolver whose identity is verified by a certificate, and sends queries through it. The network sees an encrypted connection to the resolver's IP address and nothing about the queries inside. The resolver decrypts, answers, and sends the reply back encrypted. The TLS guides on this site explain the underlying handshake. ## What encrypted DNS does and does not hide Encrypted DNS hides which domains you look up from the network and the ISP, and prevents them from altering answers. It moves that visibility to the resolver you chose, which is why the resolver's logging policy matters. It does not hide where your traffic goes. The IP addresses you connect to remain visible to the network and can often be mapped back to sites. The Server Name Indication field in the TLS handshake still reveals the hostname in plain text unless Encrypted Client Hello is in use, which browsers are gradually deploying. Encrypted DNS is one layer; to hide destinations from the network you need a VPN, described in the VPN guides on this site, or Tor. It also does not make the resolver trustworthy. A resolver that logs everything simply replaces your ISP as the observer. The value comes from choosing a resolver whose policies you accept. ## The main encrypted DNS servers compared Resolver Filtering Configurable Stated logging Notes Quad9 Blocks malware domains by default; unfiltered option No States it does not log user IP addresses Swiss non-profit foundation NextDNS Ads, trackers, malware, parental, custom lists Yes, per profile and device Optional; user chooses retention Free tier with query limit, paid unlimited AdGuard DNS Ads and trackers on default resolver; family option Yes, with a personal account Public resolver states no personal data; account service configurable Also publishes open-source AdGuard Home Cloudflare 1.1.1.1 None by default; malware and family variants No States limited, short-retention logging with independent audit Very fast, large network Google Public DNS None No States temporary and anonymised permanent logs Google-operated Quad9 answers over DoH and DoT at dns.quad9.net and blocks domains on threat-intelligence lists, which stops many phishing and malware connections at the DNS step. Its non-profit structure and Swiss jurisdiction appeal to privacy-focused users. It offers no customisation. NextDNS is a configurable resolver: create a profile, choose blocklists for ads, trackers and threats, set parental controls, add allow and deny lists, and get per-device analytics if you enable logging, or disable logging entirely. Each profile has its own DoH URL and DoT hostname. The free tier covers a monthly query allowance; the paid plan is unlimited. AdGuard DNS offers public resolvers with fixed ad and tracker blocking, a family-protection variant, and an unfiltered one, all over DoH, DoT and DNS over QUIC. Its personal service adds configurable filtering and statistics. AdGuard also publishes AdGuard Home, open-source software for running a filtering resolver at home that forwards upstream over encrypted DNS, described in the blocking guide on this site. Cloudflare 1.1.1.1 is fast and unfiltered by default, with 1.1.1.2 blocking malware and 1.1.1.3 adding adult content filtering. Cloudflare publishes a privacy commitment for the resolver and has had it audited. It is also the resolver behind Cloudflare's WARP app. Google Public DNS supports DoH and DoT and is reliable, though users seeking to reduce Google's visibility into their activity will look elsewhere. The DNS over HTTPS servers guide on this site lists the addresses and templates for each, and the enabling guide shows how to configure them on every platform. ## Encrypted DNS at home Rather than configuring each device, a home resolver such as Pi-hole or AdGuard Home can answer all local devices and forward upstream over DoH or DoT to a public resolver, adding network-wide filtering. Devices then use plain DNS only inside the home network, and everything leaving it is encrypted. Some routers support DoT or DoH forwarding directly. The blocking guide on this site covers these setups and the trade-offs, since the same tools can also be used to prevent devices from bypassing local filtering. ## A six-point checklist - Pick a resolver whose logging policy and jurisdiction you accept, and whose filtering matches your needs. - Enable DoH or DoT on each device, or run a home resolver that forwards upstream encrypted. - Verify it is working with the resolver's test page or a DNS leak test. - Understand that the resolver now sees your lookups; encrypted DNS relocates trust rather than removing it. - Pair it with HTTPS-only mode in the browser, and with a VPN or Tor when hiding destinations matters. - Expect some networks to block encrypted DNS; the troubleshooting guide on this site explains the warning and the fixes. ## What resolver operators and standards bodies say The comparison above follows the operators' published policies and the protocol specifications. The IETF specifications for DNS over TLS and DNS over HTTPS describe encrypting DNS between a client and a resolver to prevent eavesdropping and manipulation on the path, while noting that the resolver itself remains able to see queries. Quad9, NextDNS, AdGuard, Cloudflare and Google each publish privacy policies for their resolvers describing what is logged and for how long, with Cloudflare's commitments having been examined by an independent auditor and Quad9 stating it does not record user IP addresses. Privacy researchers describe encrypted DNS as a meaningful reduction in what networks and ISPs can observe, while cautioning that IP addresses and unencrypted TLS server names still reveal destinations, and that the choice of resolver determines who sees the queries instead. ## Encrypt the lookup, then choose who answers it Turning on encrypted DNS takes a minute on any device and removes one of the last plain-text records of your browsing from every network you use. Choose Quad9 for simplicity and malware blocking, NextDNS or AdGuard DNS for configurable filtering, or Cloudflare for speed, and follow the enabling guide on this site to set it up everywhere. ## FAQ Q: What does encrypted DNS traffic mean? A: It means the requests your device sends to translate domain names into IP addresses are wrapped in encryption, using DNS over HTTPS or DNS over TLS, so that the local network, your ISP and anyone in between cannot read or alter which sites you look up. Only the DNS resolver you chose can see the queries. Q: What is an encrypted DNS server? A: A DNS resolver that accepts queries over DNS over HTTPS or DNS over TLS rather than only plain UDP port 53. Public examples include Quad9, NextDNS, AdGuard DNS, Cloudflare and Google Public DNS, and many home network tools such as Pi-hole and AdGuard Home can forward to them. Q: Is Quad9 encrypted DNS? A: Yes. Quad9 supports DNS over HTTPS at its dns.quad9.net address and DNS over TLS on the same hostname, blocks domains known to serve malware by default, and is operated by a Swiss non-profit foundation that states it does not log the IP addresses of users. Q: What is the difference between NextDNS and AdGuard DNS? A: Both are encrypted resolvers that block ads and trackers, with configurable profiles and per-device settings. NextDNS is a service offering a free tier with a monthly query limit and a paid unlimited plan; AdGuard DNS offers a public resolver with fixed filtering plus a personal account service, and AdGuard also publishes the open-source AdGuard Home for running your own. Q: Does encrypted DNS hide my browsing from my ISP? A: It hides the domain names you look up, which is a large part of what an ISP learns. It does not hide the IP addresses you connect to, and without Encrypted Client Hello the server name may still be visible in the TLS handshake. For hiding the destination of your traffic, a VPN or Tor is needed; encrypted DNS is one layer.