Why encrypt DNS at all
Classic DNS travels in plain text on UDP port 53. Anyone on the path, the coffee shop Wi-Fi, your ISP, a hotel network, can read every name your device looks up and can rewrite the answers. Encrypted DNS wraps the same questions and answers in TLS, so only you and the resolver see them, and the resolver's identity is verified by certificate. Three ways to do that are in common use.
The three transports
| DNS-over-TLS (DoT) | DNS-over-HTTPS (DoH) | DNS-over-QUIC (DoQ) | |
|---|---|---|---|
| Standard | RFC 7858, 2016 | RFC 8484, 2018 | RFC 9250, 2022 |
| Port | TCP 853 | TCP 443, same as web traffic | UDP 853 |
| Looks like | Obviously DNS to a network observer, but unreadable | Indistinguishable from HTTPS | Obviously DoQ by port, unreadable |
| Speed | One TLS handshake, then fast; connection kept open | Slightly more overhead per query; HTTP/2 multiplexes well | Fastest: no head-of-line blocking, 0-RTT reconnects |
| Easy to block by a network | Yes, drop port 853 | Hard: blocking 443 breaks the web | Yes, drop UDP 853 |
| Built into | Android 9+ (Private DNS), iOS/macOS profiles, systemd-resolved, Fritz!Box, ASUS, Unbound, AdGuard Home | Windows 11, Firefox, Chrome, Edge, Brave, iOS/macOS profiles, RouterOS 7, OpenWrt package, UniFi DNS Shield | Android 11+ via Private DNS on some builds, AdGuard Home, dnsdome Android app clients, few OSes natively yet |
| dnsdome address | <token>.dns.dnsdome.com | https://dns.dnsdome.com/dns-query/<token> | <token>.dns.dnsdome.com |
The token: identity without an IP
Plain DNS has no room for "who is asking" beyond the source IP, which is why plain-DNS services need you to allowlist your IP and break when it changes. Encrypted transports connect by name, and a name can carry a secret. dnsdome gives every profile, and every device under it, its own token embedded in the hostname or URL. The resolver sees the token, applies that profile's rules, and logs the query under that profile or device. Your IP is irrelevant, so it works on mobile data, at a hotel, and behind a dynamic home connection.
Because the token is the key to your profile, treat it like a password. If one leaks, the panel's Generate new endpoints revokes it within a minute, per profile or per device.
Which one to pick
- Android phone or tablet: DoT, through the built-in Private DNS setting. Two taps, no app. Guide.
- iPhone, iPad, Mac: either, through a configuration profile. DoH if you expect hostile networks that block 853. Guide.
- Windows 11: DoH, it is the only one Windows speaks natively. Guide.
- Linux laptop: DoT through systemd-resolved. Guide.
- Browser only: DoH, the only option browsers offer. Guide.
- Router: whatever the firmware has. RouterOS 7, OpenWrt and UniFi do DoH; Fritz!Box, ASUS, pfSense and OPNsense do DoT. All the router guides use the encrypted upstream where possible, because it frees you from allowlisting a changing WAN IP.
- DoQ: when the client supports it, it is the fastest and most robust on lossy mobile networks. Few operating systems have it built in yet; the AdGuard Home forwarder does.
Two things encrypted DNS does not do
- It does not hide which sites you visit from the network. The TLS handshake to the website still shows the server name in most cases, and the destination IP is always visible. Encrypted DNS stops eavesdropping and tampering on the DNS step; it is not a VPN.
- It does not hide anything from the resolver. The resolver decrypts your query to answer it. Choosing who that is, and where they keep logs, is the real privacy decision. dnsdome resolves and logs in the EU only; see the privacy policy.