Mobile Networking · Network Privacy · Lesson 2 of 4

Encrypted DNS

Learn how encrypted DNS hides your lookups and how to turn it on.

Why Plain DNS Leaks

Every time an app needs a server's address, your phone asks a DNS resolver. Traditional DNS sends those questions as plain, unencrypted text, usually on port 53. Anyone along the path, such as the Wi-Fi owner or your carrier, can read every name your phone looks up. In some cases they can even change the answers.

Encrypted DNS wraps those lookups in the same kind of encryption HTTPS uses. There are two common versions.

• DNS over TLS (DoT) uses its own port, 853. That makes it easy to spot, and easy for a network to block.
• DNS over HTTPS (DoH) sends lookups over port 443, mixed in with ordinary web traffic.

Encryption protects your lookups on the way to the resolver. The resolver you pick still sees every name you ask about, so choosing one is again a question of trust. Encrypted DNS also leaves other clues in place. The network can still see the IP addresses you connect to, and usually the site name sent at the start of each HTTPS connection.

Turning It On

Android added a setting called Private DNS in Android 9 (2018). It uses DNS over TLS for the whole phone. You'll usually find it under Network & internet, though the exact path varies by phone maker. It has three choices.

• Off uses the network's plain DNS.
• Automatic is the default. The phone upgrades to encryption when the network's resolver supports it.
• Private DNS provider hostname sends every lookup to a resolver you name, such as dns.example.

Hostname mode is strict. If the phone can't reach your chosen resolver, Android reports that the network has no internet access instead of quietly using plain DNS. On Android 11 and later, a Google system update lets phones use DNS over HTTPS with a few well-known providers.

iPhones have supported encrypted DNS since iOS 14, with both DoT and DoH. There's no simple switch in Settings. You install a configuration profile or an app from a DNS provider, and it shows up in the VPN and device management area of Settings. Only install profiles from providers you trust, since a profile can change where your traffic goes.