Almost a year ago, we had a look at optimising your DNS for better network performance. We have since explored if it is valuable to host your own DNS server (spoiler: it most definitely is) as well as looking at Technitium DNS. We even went as far as installing and setting up Technitium DNS at home. This drastically shaped the way our network, and by extension, our internet browsing experience has changed. However, there is something we have not looked at yet, and it is something that can add a lot of value to our privacy and security: Encrypted DNS.
What is DNS and Why Do We Need It?
Imagine trying to remember a changing numerical address for every website you visit. Impossible, right? That's where the Domain Name System (DNS) steps in.
Here's how it works when you type a website address (like "www.google.com") into your browser:
- Your Computer Asks: Your computer sends a request to a special server called a DNS resolver. Think of this server as a friendly operator who knows the internet's phonebook.
- The Resolver Looks Up the Number: The DNS resolver checks its cache or queries other DNS servers to look up "www.google.com" in its records and finds the corresponding IP address (the numerical address).
- The Resolver Tells Your Computer: The DNS resolver sends the IP address back to your computer.
- Your Computer Connects: Your computer uses this IP address to connect to Google's servers and display the website.
Cached answers can avoid a new lookup, while an uncached lookup may require several steps. A page can also trigger requests for domains used by embedded resources. It's essential for making the internet user-friendly.
The Problem with Traditional DNS
The traditional way your computer talks to DNS resolvers is usually unencrypted. This means that anyone that intercepts that request, in this case, the website address you're trying to visit, can see the address in clear text.
This lack of encryption has a few key drawbacks:
- Domain Lookups Are Exposed: An observer on the DNS path can read plaintext queries. They can reveal useful information about activity, but queries are not an exact browsing history: apps make background requests, caches suppress some lookups, and DNS does not normally contain the full URL or page content.
- Potential for Manipulation: Unencrypted DNS requests can be intercepted and manipulated. Malicious actors could redirect you to fake websites designed to steal your passwords or personal information. This is known as DNS spoofing. We will go into more detail on DNS spoofing in another article, but this is a real threat. This risk depends on the transport, authentication and network path; an ISP resolver is not automatically less secure merely because the ISP supplies it.
Encrypted DNS: Securing Your Requests
Encrypted DNS reduces exposure and on-path tampering by adding transport security to the communication between your computer and the DNS resolver. Instead of sending your DNS requests as an open and unencrypted request, it gets encrypted into an unreadable format before sending. This is the same, for example, as visiting your online banking platform. The data is encrypted (via HTTPS) so that someone eavesdropping can't see the data.
There are a couple of main ways to achieve encrypted DNS:
- DNS over HTTPS (DoH): This method encrypts DNS requests and responses using the same secure HTTPS protocol that protects your communication with websites when you see "https://" in the address bar. It sends DNS messages in HTTPS requests to a resolver endpoint; this is not necessarily the same connection used to reach the website.
- DNS over TLS (DoT): This is another protocol that encrypts DNS communication using Transport Layer Security (TLS), the same technology underlying HTTPS. It uses a dedicated TLS connection, normally on TCP port 853. DoT was standardized in 2016 and DoH in 2018; neither is inherently better simply because of its name. Client configuration and server authentication matter.
How Encrypted DNS Works:
Now that we know what it is, let's look at an example to explain how encrypted DNS works. Imagine you want to look up "www.example.com".
- Your Computer Creates a Secure Connection: Instead of sending a plain DNS request, your computer establishes a secure, encrypted connection with a DNS resolver that supports DoH or DoT.
- The Encrypted Request: Your request for the IP address of "www.example.com" is then sent through this secure connection, just like the data between your machine and the actual website.
- The Encrypted Response: The DNS resolver checks its cache or queries other DNS servers to look up the IP address and sends it back to your computer through the same secure connection.
- The Protected Hop: An observer between a correctly configured client and its authenticated resolver cannot directly read the encrypted DNS message. The resolver still receives the query, and encryption of this hop does not automatically protect every upstream DNS exchange or all later website traffic.
The Benefits of Using Encrypted DNS:
- Increased Privacy: It hides the DNS payload on the encrypted hop. Your resolver remains a party you trust with those queries, so review its privacy policy and retention practices.
- Enhanced Security: Encrypted DNS makes it much harder for malicious actors to intercept and manipulate your DNS requests, reducing on-path manipulation of that connection. It cannot prevent every phishing attack, a malicious resolver or a compromised device.
- Potential for Faster Browsing (Sometimes): While not always the primary benefit, resolver location, caching and connection reuse can affect latency. Compare your own network; encryption itself is not a promise of faster internet access.
How Can You Use Encrypted DNS?
Choose the layer that should handle lookups, then follow the documentation for that exact platform:
- Operating system: Support varies by OS and release. Entering a public resolver IP address alone does not enable encryption. Some systems offer encrypted DNS controls; others require a profile or supported resolver software.
- Browser: A browser’s DoH option can protect its own lookups while other apps continue using system DNS. Check the selected provider, status and fallback behavior. Firefox, for example, distinguishes default protection from stronger modes and may use system DNS under specified conditions.
- Router or local resolver: An encrypted forwarder protects its upstream hop to the public resolver. Clients may still query that router over plaintext DNS on the LAN. Apps with their own DNS settings or a VPN may bypass it, so “whole-network” protection needs verification.
- VPN or specialist app: Check which DNS path it uses. A VPN can carry DNS inside its tunnel without the subsequent resolver connection using DoH or DoT. Test with the VPN both enabled and disabled if you use both modes.
Popular Encrypted DNS Services:
Choose a service according to its actual policy and endpoint, rather than assuming all public resolvers offer the same filtering or privacy guarantees:
- Cloudflare: The standard 1.1.1.1 service supports DoH and DoT. Its family-filtering variants use different endpoints; choose the variant intentionally.
- Google Public DNS: Supports DoH and DoT through the published
dns.googleendpoints. - Quad9: The 9.9.9.9 service includes threat blocking. Quad9 also publishes non-blocking variants, so switching addresses can change behavior.
- AdGuard DNS: Its default public service blocks ads and trackers at domain level, with separate unfiltered and family options. Domain filtering will not remove every advert or all tracking, and may occasionally affect legitimate resources.
- OpenDNS and NextDNS: These are additional services to compare. Consult their present product documentation for encrypted transport, filtering, account requirements and limits instead of treating a plain IP address or a free plan as a universal configuration.
For any provider, check retention, jurisdiction, filtering, compatibility and availability from your connection. A third-party provider changes who receives your queries; it does not eliminate the need to trust a resolver.
Protocol Comparison: Plaintext DNS vs. DoT vs. DoH vs. DoQ
| Protocol | Default Port | Transport Layer | Best Suited For |
|---|---|---|---|
| Standard DNS (Plaintext) | 53 | UDP / TCP (Unencrypted) | Legacy/default DNS; consider the trust and exposure of the relevant network hop. |
| DNS over TLS (DoT) | 853 | TCP + TLS | Clients or forwarders with dedicated DoT support. |
| DNS over HTTPS (DoH) | 443 | HTTPS (HTTP/2 or HTTP/3) | Supported browsers, OS clients or forwarders; 443 alone does not ensure a resolver is reachable. |
| DNS over QUIC (DoQ) | 853 | UDP + QUIC (TLS 1.3) | Clients and resolvers supporting dedicated DoQ; distinct from DoH carried over HTTP/3. |
Copy-Paste Encrypted DNS Provider Reference
For a supported encrypted client or upstream forwarder, including Technitium DNS, use the field appropriate to the selected protocol. DoT expects a hostname for authentication; DoH expects a URL. Not every resolver supports these natively, and some need an additional proxy. The addresses below show selected provider addresses rather than a complete redundancy configuration:
| Provider | IPv4 / IPv6 Addresses | DoT Hostname (Port 853) | DoH URL (Port 443) |
|---|---|---|---|
| Cloudflare (Privacy) | 1.1.1.1, 1.0.0.12606:4700:4700::1111 | one.one.one.one | https://cloudflare-dns.com/dns-query |
| Quad9 (Malware Blocking) | 9.9.9.9, 149.112.112.1122620:fe::fe | dns.quad9.net | https://dns.quad9.net/dns-query |
| AdGuard DNS (Ad Blocking) | 94.140.14.14, 94.140.15.152a10:50c0::ad1:ff | dns.adguard-dns.com | https://dns.adguard-dns.com/dns-query |
| Google Public DNS | 8.8.8.8, 8.8.4.42001:4860:4860::8888 | dns.google | https://dns.google/dns-query |
A Warning About Your Default ISP DNS:
Check your actual DNS path before deciding whether your ISP’s default is suitable. DHCP may advertise the router as DNS rather than a public server, and that router can forward or resolve queries in several ways. Encryption does not by itself establish a provider’s logging policy, filtering quality or resilience.
Encrypted DNS also does not make browsing anonymous. Destination IP addresses, connection timing and some handshake information can still reveal or suggest activity. Website encryption protects page contents separately, and a resolver sees the queries it answers. DNSSEC serves another purpose: it validates signed DNS data, whereas DoH or DoT protects transport. The two can be used together.
For a homelab, keep local names and deliberate filtering working. Sending all queries directly to a public resolver can bypass local records, split DNS or an ad-blocking service. Plan which names should stay local and which upstream should handle public names before changing every device.
Verify the Protected Hop
First back up your resolver or router configuration and change one layer at a time. Check provider status tools and, where available, resolver logs or a packet capture on the intended interface. A generic DNS leak test usually identifies a resolver; it does not prove every hop is encrypted.
If you use Quad9, its documented proto.on.quad9.net TXT lookup can report the protocol Quad9 received for that query. A browser test and a system resolver test can differ because the browser has its own DoH configuration. Neither result demonstrates that every application follows the same path.
Decide what should happen if the encrypted resolver is unavailable: fallback may restore connectivity while exposing plaintext queries, whereas strict behavior may stop name resolution. Test ordinary sites, local services and a new network such as a captive portal, then restore previous settings if the configuration does not meet your needs.
In Conclusion:
While DNS might seem like a technical detail, it plays a crucial role in your everyday internet experience. Traditional DNS can expose lookup names on its network path. Encrypted DNS is a useful additional protection for those messages, with clear limits around resolver trust and the rest of your browsing traffic. By understanding what it is and how it works, you can take simple steps to enable it and enjoy a more private and secure internet experience. It's like upgrading from sending postcards to sending secure, confidential letters – a small change with a significant impact on your online well-being.
We will be adding encryption to our Technitium DNS we installed in our Build your own homelab series. We will also have a quick look at Unbound as well as that is also a very popular DNS server for Homelabbers.
