DNS is the service that translates a website's name into an IP address: before your device opens a page, it asks "what is the address for this domain?" By default the question goes to your ISP's DNS server in plain text, so the ISP gets a list of every site you look up, even when the pages themselves are protected by HTTPS. Switching to a public DNS server, and better an encrypted one, takes that list away from the ISP, sometimes speeds up page loads, and protects against address spoofing on someone else's network. Here is how it works and how to change it on each device.
How a DNS lookup works
- You type or tap a site.
- Your device asks the DNS server it was given by the router or carrier for the site's address.
- The server answers, and the device connects to that address.
Answers are cached for minutes or hours, so repeat lookups are faster. The whole thing takes milliseconds, but it happens for every domain on a page, and a modern page loads dozens.
Why change the DNS server
- Privacy from the ISP. The list of domains goes to a service you chose instead. What the ISP sees with and without this is in what can my ISP see.
- Protection against spoofing on shared networks. A café's or hotel's DNS server can answer with wrong addresses. Encrypted DNS rules that out.
- Speed. Large public resolvers are often faster than ISP ones, especially on mobile.
- Filtering. Some services block advertising and malware domains at the DNS level.
What changing DNS does not do: it does not hide your IP address, does not encrypt your traffic, and does not hide the site name in the TLS handshake (SNI). For that you need a tunnel.
Which server to choose
| Server | Addresses | Notes |
|---|---|---|
| Cloudflare | 1.1.1.1, 1.0.0.1 | fast, DoH/DoT, minimal logging by policy |
| 8.8.8.8, 8.8.4.4 | fast, DoH/DoT, logging per Google's policy | |
| Quad9 | 9.9.9.9 | blocks known malicious domains |
| AdGuard DNS | 94.140.14.14 | blocks ads and trackers |
For a home user the speed difference between them is small; choose by policy and by the features you want.
Plain DNS versus encrypted: DoH and DoT
Simply changing the address to 1.1.1.1 moves your query list to a different company, but the queries still travel in plain text and the ISP can read them on the way. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt them: the ISP sees only a connection to the DNS service. If you change anything, change to the encrypted version.
How to turn it on
Android. Settings → Network & internet → Private DNS → "Private DNS provider hostname" → enter one.one.one.one or dns.google. Applies to every app, over DoT.
iPhone and iPad. No built-in switch. Options: a configuration profile from a DNS provider (Cloudflare, AdGuard and others publish them), or a VPN app that carries DNS inside the tunnel.
Windows 11. Settings → Network & internet → Wi-Fi or Ethernet → Properties → DNS server assignment → Edit → Manual, IPv4, enter 1.1.1.1 and 1.0.0.1, DNS encryption → "Encrypted only (DNS over HTTPS)".
macOS. System Settings → Network → your connection → Details → DNS → add the addresses. Encryption requires a configuration profile.
Browser on a computer. Chrome: Settings → Privacy and security → Security → "Use secure DNS". Firefox: Settings → Privacy & Security → "DNS over HTTPS". Protects the browser only.
Router. Set the public addresses in the WAN or DHCP settings so every device at home uses them. Not all routers support encryption.
How to verify
On a site such as dnsleaktest.com, run the extended test: the list of servers that answered your queries should not include your ISP's. With a VPN on, the servers should belong to the VPN service; the leak check is in is my DNS leaking.
DNS and VPN together
With a VPN on, DNS queries should go inside the tunnel to the VPN's resolvers. A third-party encrypted DNS in the browser can conflict: queries go to a different service outside the tunnel. The rule is simple: either the VPN manages DNS (the usual case), or the browser's DoH is routed through the tunnel. Not both in different directions. Encrypted DNS at the system level remains a useful fallback for the moment the tunnel drops.
In short
- Default DNS hands your ISP a list of sites; encrypted DNS removes it.
- 1.1.1.1 and 8.8.8.8 are the common choices; the difference is policy, not speed.
- Two taps on Android, a profile on iPhone, a network setting on Windows 11.
- DNS is not a substitute for a VPN: the IP and SNI stay visible. Together they cover nearly everything.
404 VPN runs DNS inside the tunnel on its own resolvers, and the kill switch blocks traffic if the tunnel drops. Details on the how it works page; get started here.