How DNS-over-HTTPS Protects Your Browsing and How to Enable It

Every time you visit a website, your device looks up its address using DNS, the internet's phone book. Traditionally those lookups travel unencrypted, so your internet provider and anyone on your network can see every site you look up. DNS over HTTPS (DoH) encrypts them.

What it protects

• Hides your lookups from your Wi-Fi network, your internet provider and anyone snooping in between.
• Stops lookups from being tampered with to send you to fake sites.
• Prevents some providers from redirecting mistyped addresses to ad pages.

What it doesn't

• Your provider can still see the IP addresses you connect to, and often the site name during the secure connection setup. Encrypted Client Hello (ECH), supported in Chrome since 2023 and in Firefox, hides that name on sites that support it.
• The DoH provider itself sees your lookups, so choose one you trust.
• It doesn't hide your IP address from websites. That needs a VPN. See what your IP address reveals.

How to turn it on

• Chrome: Settings → Privacy and security → Security → Use secure DNS. "With your current service provider" uses DoH automatically when your provider supports it; or choose a provider from the list.
• Edge: Settings → Privacy, search, and services → Security → Use secure DNS.
• Firefox: Settings → Privacy & Security → DNS over HTTPS. It's on by default in the US.
• Windows 11: Settings → Network & internet → your connection → DNS server assignment → Edit, then set encryption to "Encrypted only (DNS over HTTPS)".

Choosing a provider

• Cloudflare (1.1.1.1): fast, with published privacy commitments.
• Google Public DNS (8.8.8.8): fast and widely used.
• Quad9 (9.9.9.9): blocks known malicious sites, run by a non-profit.
• Family filters: some providers offer versions that block adult content.

When it can cause problems

• Work and school networks use their own DNS for filtering and internal sites; managed browsers may turn secure DNS off.
• Parental controls on your router can be bypassed by browser DoH, which is why some families switch it off on children's devices.
• Some VPNs handle DNS themselves; check your VPN's settings.

More network privacy

Pair secure DNS with a Chrome privacy checklist. If you use a VPN, WebRTC Privacy Shield stops Chrome's video-call features from revealing your real IP address. See checking for location leaks.