Secure DNS encrypts the lookups your device makes when it turns a website name into an IP address, so your internet provider or anyone on public Wi-Fi cannot see or tamper with which sites you are looking up. It usually works through DNS over HTTPS (DoH) or DNS over TLS (DoT), and you can switch it on for free in Chrome, Edge, Firefox, Windows 11 and Android in under a minute.
Here is what secure DNS protects, what it does not, and step-by-step instructions for every major browser and device.
How Regular DNS Leaks Your Browsing
Every time you visit a site, your device asks a DNS resolver for its IP address. Traditional DNS sends that question in plain text, so your internet provider, the Wi-Fi owner or anyone snooping on the network can see every domain you look up, and an attacker can even forge the answer to send you to a fake site. If DNS is new to you, start with our explainer on why we need the Domain Name System.
Types of Secure DNS Explained
| Technology | What it does | Where you see it |
|---|---|---|
| DNS over HTTPS (DoH) | Encrypts DNS inside normal HTTPS traffic | Chrome, Edge, Firefox, Windows 11 |
| DNS over TLS (DoT) | Encrypts DNS over a dedicated secure channel | Android “Private DNS”, many routers |
| DNSSEC | Digitally signs DNS answers so they cannot be forged (does not hide them) | Set up by domain owners and resolvers |
Cloudflare’s explainer on DNS over TLS vs DNS over HTTPS covers the technical differences.
How to Turn On Secure DNS
Google Chrome
- Open Settings > Privacy and security > Security.
- Scroll to Advanced and switch on Use secure DNS.
- Keep your current provider or choose one such as Cloudflare, Google or Quad9.
Microsoft Edge
Go to Settings > Privacy, search, and services, find the Security section and turn on Use secure DNS.
Mozilla Firefox
Open Settings > Privacy & Security, scroll to DNS over HTTPS and choose Increased Protection or Max Protection.
Windows 11 (whole system)
- Go to Settings > Network & internet and choose Wi-Fi or Ethernet.
- Click Hardware properties, then Edit next to DNS server assignment.
- Switch to Manual, turn on IPv4 and enter a DoH-capable resolver such as 1.1.1.1 or 8.8.8.8.
- Set DNS over HTTPS to On (automatic template) and save.
Android
- Open Settings > Network & internet (or Connections > More connection settings on Samsung).
- Tap Private DNS.
- Choose Private DNS provider hostname and enter one.one.one.one (Cloudflare), dns.google (Google) or dns.quad9.net (Quad9).
iPhone and iPad
iOS supports encrypted DNS but does not have a simple toggle for it. The easiest method is installing a resolver’s app, such as Cloudflare’s 1.1.1.1 app, or a DNS configuration profile from a trusted provider. Safari users on iCloud+ also get encrypted DNS through iCloud Private Relay; see our comparison of iCloud Private Relay vs a VPN.
Best Secure DNS Providers
- Cloudflare (1.1.1.1): fast, privacy-focused, with optional malware or family filtering variants.
- Google Public DNS (8.8.8.8): reliable and widely supported.
- Quad9 (9.9.9.9): nonprofit resolver that blocks known malicious domains.
- NextDNS: customisable filtering and logs you control.
What Secure DNS Does Not Hide
- The IP addresses you connect to. Your provider can still see which servers you talk to.
- Some site names during connection setup, unless the site supports newer encryption features.
- Your identity from websites. Sites still see your IP address and can track you with cookies.
- Traffic from other apps if you only enable it in your browser.
For full traffic protection, a VPN encrypts everything between your device and the VPN server, including DNS. Our guides to how a VPN works and double VPN cover the next level of privacy.
Secure DNS FAQ
Should I turn on secure DNS?
Yes, for most people. It improves privacy and protects against DNS tampering with no cost and little or no speed impact.
Does secure DNS slow down the internet?
Usually not noticeably. A fast public resolver can even make sites start loading quicker than your provider’s default DNS.
Is secure DNS the same as a VPN?
No. Secure DNS only encrypts DNS lookups; a VPN encrypts all your traffic and hides your IP address from websites.
Why is secure DNS greyed out in Chrome?
It is often disabled when parental controls, a work or school policy, or some antivirus tools manage your DNS settings.