Skip to content
disable.page

Home DNS Encrypted DNS: what changes with DoH and DoT

Encrypted DNS: what changes with DoH and DoT

Encrypting the query hides the name being looked up from whoever shares the network. It does not hide it from the server that answers, nor from whoever controls the device.

What encrypted DNS hides

On an open network like a café or a hotel, anyone sniffing the traffic sees the names the devices look up: the sites visited, the services used by apps, the updates that get downloaded. With DNS over TLS or over HTTPS, the query travels encrypted to the resolver and the network sees only a connection to that server.

The effect is larger on shared networks and on mobile devices, where the network operator has reason to catalogue what each person looks for. It is not an absolute shield: the resolver still sees everything, and the first connection can still be intercepted by whoever controls the network.

Who still sees

If the resolver belongs to your provider, encrypting the route changes nothing for them: they are the recipient of the query. Once you run a resolver of your own, the relevant question stops being who sees the query on the way and becomes who answers at the end.

That is where the second concern appears. Concentrating queries in a single server increases your dependence on it: if the service goes down, browsing stops; if it is compromised, all name traffic passes through a single place. A well-configured resolver compensates with per-device query logs, a short retention policy, and the possibility of checking the history.

When the browser decides on its own

Browsers such as Chrome and Firefox offer a secure DNS option that uses the browser's own server instead of the one set on the network. That avoids local interception, but it also means the server chosen is the browser's, and not yours.

In environments managed by a company, the choice is usually imposed by device policy, and the user never notices. There are also apps that ship with encrypted DNS already on and ignore what the device is configured to do. Checking which server actually answered is therefore information worth having.