Encrypted DNS (DoH, DoT, DoQ) versus a VPN
Encrypted DNS stops your network operator reading which domains you look up, and leaves the rest of your traffic exactly as visible as before. A VPN hides lookups and destinations together. Encrypted DNS is the cheaper first step and not a substitute.
4 min read
DNS was designed in the 1980s with no encryption at all, which means every lookup your device makes has traditionally been readable by anyone on the path — your network operator most of all. Three protocols now fix that, and they are frequently presented as an alternative to a VPN. They are not; they are a different and narrower thing.
The three protocols
DoT — DNS over TLS, RFC 7858. Runs on port 853 with its own TLS session. Distinguishable by port, so a network can block it easily. This is what Android's Private DNS setting uses.
DoH — DNS over HTTPS, RFC 8484. Runs on port 443, indistinguishable from ordinary web traffic. Harder to block, and the reason it is controversial with network operators who relied on seeing DNS.
DoQ — DNS over QUIC, RFC 9250. Over QUIC on UDP, avoiding TCP's head-of-line blocking. Newest and least deployed.
All three encrypt the query between your device and the resolver. None encrypts anything else.
What encrypted DNS gives you
Your network operator cannot read your lookups. That removes roughly half of the destination list they would otherwise compile.
The other half is the Server Name Indication field in each TLS handshake, which carries the hostname in the clear until Encrypted Client Hello is widely deployed. So encrypted DNS closes one of the two leaks, not both.
What a VPN gives you
Everything encrypted DNS gives, plus destinations, plus your address being hidden from the sites you reach, plus protection for non-web traffic.
Side by side
| Encrypted DNS | VPN | |
|---|---|---|
| Hides lookups from the network | Yes | Yes |
| Hides destination hostnames | No | Yes |
| Hides your address from sites | No | Yes |
| Covers non-browser traffic | Depends on where it is set | Yes |
| Speed cost | None measurable | 10 to 30 percent |
| Setup | Minutes, free | An app and a subscription |
| Who sees your lookups | The resolver you chose | The tunnel's resolver |
They interact, sometimes badly
This is the part worth knowing, because it produces confusing test results.
If DNS over HTTPS is configured in your browser and a VPN is running, the browser's lookups go to its own resolver rather than the tunnel's. Encrypted, so nobody on the network reads them — and not where the VPN intended, so a leak test reports a resolver you never configured.
Android's Private DNS is stronger still: it applies system-wide and takes precedence over the tunnel's resolver, by design.
The coherent configurations are either encrypted DNS with no VPN, or a VPN with browser and system encrypted DNS set to automatic. Running both with explicit resolvers means your lookups and your traffic go to different parties, which is not obviously better than either alone.
Check which you have with the DNS leak test.
Who you are trusting
Encrypted DNS moves your lookups from your ISP to whichever resolver you chose. That is an improvement if you trust the resolver more, and it is not anonymisation — the resolver sees every domain you ask for, tied to your address.
Choose deliberately. The default resolvers browsers use are large operators with published policies, which is a reasonable starting point and worth reading rather than assuming.
The practical recommendation
Turn on encrypted DNS regardless. It is free, it takes minutes, and it closes a real leak.
Add a VPN if the destination list, your address, or an untrusted network is also a concern. Confirm what you actually present with what is my IP afterwards, because the interaction between the two is the most common source of a configuration that looks right and is not.
Why network operators object to DoH specifically
Because it moves DNS out of their control, and several legitimate things depended on that control: parental filtering, malware blocking at the network level, split-horizon DNS resolving internal names inside a corporate network, and captive portal detection.
An enterprise network where every laptop resolves through an external resolver loses its ability to enforce policy at the DNS layer and to resolve its own internal hostnames. That is a real operational problem rather than a complaint about privacy, and it is why managed devices frequently have DoH disabled by policy.
At home the same trade appears in miniature: a router-level ad blocker stops working for any device that resolves elsewhere.
Where to configure it
In the browser covers browsing only, and is the easiest.
In the operating system covers everything on the device. Android calls it Private DNS; Windows, macOS and iOS all support it in recent versions.
On the router covers every device including the ones that cannot configure it themselves, and is the option that keeps household-level filtering working.
The last is the most complete and the one most likely to conflict with a VPN, in the ways described above. Pick one layer deliberately rather than enabling it at all three.
