DNS over HTTPS and TLS: Setup in Every Browser and OS

Before your browser can load a site it asks a DNS resolver to turn a domain like example.com into an IP address. Traditionally that lookup travels in plaintext, so your ISP, network operator, or anyone sniffing the connection can read every domain you visit — even when the page itself is HTTPS. DNS is one of the biggest privacy leaks left in ordinary browsing.

DNS over HTTPS (DoH) and DNS over TLS (DoT) both fix this by encrypting the query between you and the resolver. The practical difference: DoH sends DNS inside normal HTTPS on port 443, so it blends in with web traffic and is hard to block or distinguish; DoT uses a dedicated port (853), which is cleaner architecturally but easier for a network to spot and block. Browsers favour DoH; operating systems support both. You can test what your resolver sees on the DNS tool.

Encrypted DNS hides which domains you look up from your ISP and on-path observers, and stops DNS-based tampering. That is a real privacy and integrity win. But be clear on its limits: your chosen resolver still sees your queries, so you are shifting trust from your ISP to that provider — pick one with a strong privacy policy. It also does not hide the destination IP you then connect to, and TLS SNI can still reveal the hostname unless Encrypted Client Hello is in play.

How this relates to a VPN: a properly configured VPN already routes your DNS through its own resolver inside the encrypted tunnel, so your ISP sees neither your DNS nor your traffic. That is why checking for a DNS leak matters — if lookups escape the tunnel to your ISP's resolver, encryption on the rest of your traffic is undermined. DoH/DoT and a VPN are complementary: encrypted DNS protects lookups on any network; a VPN protects the whole connection and its DNS together.