- Setting up private and encrypted DNS strengthens privacy and security by protecting queries against eavesdropping and manipulation.
- Android, browsers, and desktop systems offer support for DNS over TLS and DNS over HTTPS with trusted public providers.
- Choosing good DNS servers can speed up website loading, block malicious domains, and reduce tracking by third parties.
Most of the time when we connect to the internet, we don't even notice what's happening behind the scenes: we open the browser, type in an address, and that's it. But in each of these actions, there's a key element that often goes unnoticed: the DNS that resolve domain names that we visit. And that's where configuring private DNS comes in to gain security and privacy.
For some years now, both mobile phones and computers have been incorporating technologies such as DNS over TLS and DNS over HTTPS that allow encrypt DNS queries So that no one can easily snoop on which websites you visit or manipulate your traffic. If you choose the right provider and invest a couple of minutes in the setup, you can have a much more secure browsing experience without any hassle.
What is DNS and why is it so important for your browsing?
The Domain Name System, or DNS, acts as a kind of Internet phonebook that translates names to IP addressesWhen you type something like "example.com" into your browser, your device doesn't immediately know where that server is; it sends a DNS query so that a specialized server can return the exact IP address to which it should connect.
This system is distributed worldwide and operates hierarchically: your device asks the nearest or default DNS server (usually your internet service provider's), and it queries other servers until it finds the correct answer. It all happens in milliseconds, which is why we're almost never aware of the process.
The relevance of DNS is enormous because Virtually every action on the Internet starts with a DNS request.Opening a website, checking email, streaming a video, or using an app that connects to a remote service—if the DNS link is weak, everything that follows is also vulnerable.
Traditionally, these consultations were carried out in plain text, without any encryptionThis meant that anyone who could spy on your network (from your own internet provider to an attacker on public WiFi) could easily see which domains you were visiting or even manipulate those responses.
Risks of using unencrypted DNS and common attacks
When DNS requests travel unprotected, several security problems arise. The most well-known is... DNS cache poisoning or manipulationIf an attacker manages to introduce false responses into the server or your device, they can redirect you to fraudulent pages that impersonate legitimate sites.
This type of attack can lead to cases of Very convincing phishingImagine you type in your bank's address and, due to a manipulated DNS, you end up on an exact copy of the real website, but managed by criminals. You enter your credentials thinking everything is fine, but in reality, you're handing them over to the attacker.
Another sensitive issue is privacy. A plaintext DNS allows that Anyone with internet access can collect a very detailed record of your browsing habits.What sites you visit, when, and how often. In the hands of a provider or a company with commercial purposes, this is pure gold for profiling you; in the hands of an attacker, it's sensitive information that can be exploited.
In addition to spoofing attacks, insecure DNS can be used for arbitrarily block access to certain domainsSome internet service providers filter websites using DNS to comply with legislation or internal policies. Switching to private, more privacy-conscious servers is a simple way to regain that control.
Finally, if the DNS server is slow or misconfigured, it can negatively impact the user experience: Each website will take longer to start loadingbecause name resolution becomes a bottleneck. It's not uncommon to notice speed improvements when switching to faster, optimized DNS servers.
Technologies to protect queries: DNS over TLS and DNS over HTTPS
To solve these problems, several technologies that encrypt DNS queries have been standardized. Two of the most widespread are DNS over TLS (DoT) and DNS over HTTPS (DoH)The idea is similar in both cases: to wrap DNS requests within an encrypted channel, so that no one between your device and the server can see or modify the content.
DNS over TLS uses the TLS transport layer, the same one that protects, for example, HTTPS traffic, but applied directly to the DNS protocol. Android, starting with version 9, integrates this system under the name of Private DNSso that all system name resolution traffic is automatically encrypted to the chosen server.
DNS over HTTPS, on the other hand, encapsulates DNS requests within standard HTTPS connections. Many modern browsers have added DoH support directly in your settingsso that name resolution is performed in an encrypted tunnel to compatible providers such as Cloudflare, Google or NextDNS, among others.
In both cases, it is ensured that neither the Internet provider nor potential spies on public WiFi networks can read clearly which domains you are resolving nor can they easily inject fake responses. Furthermore, secure DNS providers typically combine encryption with malicious domain lists to block malware, phishing, or spam websites.
However, there's an important caveat: you still have to rely on your chosen DNS provider. Although many reputable companies claim do not register or commercially exploit your queriesIt's advisable to review their privacy policies and terms of use before making a decision, and if you're looking for complementary alternatives, consider those as well. The most secure VPNs for your device.
How private DNS works on Android: DNS over TLS
Google incorporated a feature called Private DNS in Android 9 Pie, which implements DNS over TLS at the system level. This means that all apps on the phone, without exception, They use the same encrypted DNS channel that you configure, without you having to touch each application separately.
The catch is that this feature depends on your internet provider or the DNS server you use supporting DNS over TLS. If your provider doesn't support it, you'll find that automatic mode doesn't provide real encryption, and you'll have to manually configure it. Manually enter a compatible server, such as those from Google Public DNS or Cloudflare, through their hostname.
There are tools on the web, such as tests from specialized security websites, that allow you to check if Your connection is actually using TLS for DNS queriesIf the tests indicate that it does not, you can opt for one of the best-known alternative providers that do support this protocol.
The general steps to activate or change private DNS on Android are usually similar, although each manufacturer rearranges the menus in their own way. You'll typically need to go into the In your phone settings, go to Connections or Networks & Internet and locate the private DNS section. Once there, you can choose to leave it in automatic mode, disable it, or specify a particular hostname.
On phones with somewhat complex custom interfaces, like some Xiaomi models, the setting might not be immediately visible. In those cases, it helps. Use the built-in search bar on the settings screen by typing "Private DNS" or resort to utilities that expose hidden settings, such as the well-known apps for accessing advanced MIUI menus.
Practical guide: setting up private DNS on Android step by step
On most devices running Android 9 or higher, enabling private DNS with TLS encryption is quite straightforward and will only take a moment. Generally, the process looks something like this: Open Settings, go to the Connections or Networks section, and look for the "Private DNS" option..
When you enter that menu, you'll see that, by default, the option is usually set to "Automatic." This means your phone will use whatever your network or carrier offers. If you really want to get the most out of it, change the mode to an option similar to... "Private DNS provider hostname" or equivalent text (according to your manufacturer's translation).
In the box that appears, you'll need to enter the host of the service you want to use. For example, to use Google's encrypted DNS, you should type dns. googleIf you prefer Cloudflare, one of the common values for DNS over TLS is 1dot1dot1dot1.cloudflare-dns.comEnter the one that corresponds to the chosen provider and save the changes.
Once the new configuration has been accepted, it is recommended Restart your phone to ensure all connections are re-established using the new private DNS.From that moment on, all system DNS queries will go through the encrypted tunnel to the configured provider, both in the browser and in any installed app.
This method has the advantage that you don't need to install third-party applications or configure anything on each Wi-Fi network individually. As long as your chosen provider supports DNS over TLS, You'll enjoy an added level of privacy and protection against response manipulation., without losing compatibility with your mobile operator or your fiber connection.
Configure private DNS on Android and iOS phones without “Private DNS” mode
On devices that do not have system-level private DNS mode, or on older versions of Android, you can also manually change the DNS settings you use on each WiFi networkIt's less elegant, but equally useful for bypassing blocks or gaining performance.
On Android, the typical way is to open the WiFi settings, press and hold on the network you're connected to, and choose the option to modify or edit networkNext, enable advanced options and change the IP configuration from automatic (DHCP) to static or manual. This will allow you to enter addresses for DNS 1 and DNS 2.
On iOS, the process is similar, but with its own terminology. You need to go to Wi-Fi settings, tap the "i" icon next to your network, and enter the section for DNS configurationFrom there you can switch to manual mode and add as many DNS server addresses as you want, deleting those provided by your operator if you wish.
The drawback of this approach is that it only affects that specific network. If you switch Wi-Fi networks or use mobile data, You will revert to using the default DNS settings. from the operator unless you repeat the process wherever possible. Even so, for the home or office connection you use daily, it's a very effective method. If you're looking for extra privacy, you can also Using Tor on Android.
It's worth remembering that when you change DNS settings this way, the queries themselves aren't encrypted unless the operating system or browser implements DoH-type technologies. What you do achieve is choose a faster, more private provider or one with filtering features than the one your router imposes by default.
Enable DNS over HTTPS (DoH) in desktop browsers
On computers running Windows, macOS, or Linux, in addition to changing the DNS settings at the system level, you have another very interesting option: to activate DNS over HTTPS directly in your browserThis means that, even if the system uses regular DNS, the browser encrypts its own queries to a trusted provider.
In Chromium-based browsers, such as Microsoft Edge, DoH support has been integrated and, in many versions, can be enabled from the advanced settings menus. In certain builds, it is also possible to use the menu of experimental functions (flags) by typing something like "edge://flags" in the address bar and looking for the option of secure resolutions, such as "Secure DNS lookups".
For Google Chrome the procedure is very similar: you can access chrome://flags and also search for "Secure DNS lookups" To activate it if it doesn't already appear in the standard settings, which has been common in previous versions or channels like Canary. After enabling it, the browser restarts and switches to using DoH with certain compatible providers.
Firefox has its own, somewhat different approach. Instead of hiding it in experimental flags, it allows you to enable DNS over HTTPS directly from the preferences menu. Within the General section, you'll find a block dedicated to... Network settings, where you can check the box to enable DNS via HTTPS and choose a default provider, usually Cloudflare or NextDNS.
Although DoH in the browser does not protect queries from other system applications, it does represent a substantial improvement for the Web browsing, which is where we spend most of our timeFurthermore, because they are encrypted, it is more difficult for the provider or an attacker in the middle to easily capture the history of websites visited.
Leading providers of secure and fast public DNS
There are a number of public DNS services that have become popular for offering faster speeds, filtering features, or clearer privacy policies than many traditional providers. Among the best known are: Cloudflare, Google Public DNS, OpenDNS, Quad9, AdGuard DNS, DNS.Watch or Dyn, among others.
Cloudflare, with its famous 1.1.1.1, is a benchmark in performance and privacy. It offers implementation of DNS over HTTPS and DNS over TLSIt ensures that query logs are deleted within a short period and has strongly positioned itself as the default option in many browsers and systems.
Google Public DNS, accessible through IPs such as 8.8.8.8 and 8.8.4.4, is another widely used veteran. It provides a very robust global infrastructure and generally very low response timesFurthermore, it has also adopted both DoH and DoT, allowing it to be used in environments where encryption is required.
OpenDNS, now owned by Cisco, combines name resolution with advanced features of security, content filtering, and parental controlsIt offers free options and paid plans for home or business environments, and uses technologies such as DNSCrypt to encrypt queries.
Quad9 is another interesting alternative because it focuses on blocking domains associated with malware, phishing, and other types of threatsIt leverages threat intelligence feeds and third-party security services. Like many of the previous ones, it also supports DoH for those who want end-to-end encryption.
In addition to these, there are specialized options such as AdGuard DNS, which focuses on removing ads and trackers at the DNS levelOr DNS.Watch, which prioritizes a no-logs policy and transparency. The choice will depend on whether you prioritize pure speed, strict privacy, content filtering, or a balance of everything.
Advantages and risks of using private DNS versus ISP-provided DNS
Configuring private DNS servers instead of using the ones that come with your router by default offers a number of benefits. To begin with, you can significantly increase your privacy by hiding a large portion of your DNS queries from your operator, which means you no longer have total control over which domains you resolve.
Secondly, many of these services are designed to be especially fast at resolving IP addressesThis means that the initial connection to websites is usually faster, resulting in a smoother browsing experience, especially on pages with many external resources.
In addition, there are filtering options. Certain providers offer predefined lists to block malicious websites, phishing domains, or even ads and trackersWithout installing extensions or changing anything in the browser, some of that unwanted traffic is blocked directly at the DNS level.
However, it's not all advantages. When you use a private DNS, that company gains a fairly detailed view of your online activity, even though the queries are encrypted between you and them. That's why it's crucial Choose trusted providers, review their data policies and, where possible, prefer those that commit to limiting or eliminating activity logs.
Another point to watch out for is dependency: if the chosen provider experiences an outage or connectivity problems, Your internet access may be affected even if your physical connection is perfect.That's why it's recommended to always configure a secondary DNS or have alternatives on hand to quickly switch to in case of failure.
Change DNS settings on Windows, macOS, and other devices
In addition to mobile devices and browsers, you can configure private DNS directly on your computer so that all system applications use those serversfrom the browser to email clients, online games or desktop tools.
In Windows, the usual procedure begins in the Control Panel, within the Network and Internet section. From there you access the Network and Sharing Center, and then the option to change the adapter settingsOnce you locate the active connection (Ethernet or WiFi), open its properties.
Within the properties, you need to select the element "Internet Protocol version 4 (TCP/IPv4)" and click on "Properties"In the window that appears, you can check the box to use specific DNS server addresses and enter the IPs of the desired providers, both primary and secondary, saving the changes when finished.
On macOS, you'll find this in System Preferences. Within the "Network" section, select your connection type (for example, Wi-Fi) and click "Advanced." On the tab DNS has buttons to add new server addressesThese will be used in the order indicated. Once entered, simply accept and apply the new configuration.
Other devices, such as smart TVs, game consoles, or IoT systems, also allow define the DNS manually within your network menusAlthough not all browsers support encryption, changing these settings can help improve the loading speed of streaming content or reduce exposure to malicious websites when they include an integrated browser.
If you'd rather not go device by device, another option is to change the DNS settings directly on your router. This way, All devices connected to the network will inherit those servers.However, in this case you still don't have query-level encryption, unless the devices use DoH or DoT separately.
DNS, browsing speed and protection against attacks
The quality of the DNS server you use has a real impact on how fast your connection feels. A good provider maintains large cached databases, distributed worldwide, to respond quickly to the most common requests without having to ask other servers repeatedly.
In addition, some services apply intelligent optimization techniques that allow direct yourself to content servers that are closer or less congestedreducing overall latency. This is especially noticeable on very heavy pages or services that make many connections to different domains.
In terms of security, secure DNS adds an extra layer of defense. They typically rely on databases of malicious, phishing, malware distribution, or spam domains to block requests to those destinations on the fly. They don't replace a good antivirus or user caution, but they do help stop many attacks before they start.
Furthermore, the use of DNS encryption over TLS or HTTPS makes it more difficult for intermediary actors to modify responses or intercept traffic to redirect you to fake websitesAn attacker can no longer simply inject fake packets in plain text; they need to break or bypass the secure channel, which is much more complex.
Looking ahead, approaches such as Blockchain-based DNS, where resolution information is stored and validated on blockchainsAlthough it is still an emerging technology and not without its challenges, its goal is to prevent the centralized manipulation of records and increase transparency and resilience to attacks.
Choosing and correctly configuring private DNS has become a simple yet powerful gesture for any user who cares even slightly about their security and digital privacy: with a few adjustments and by using reputable providers, it is possible to enjoy faster connections, reduce exposure to poisoning or phishing attacks, and hide much of your browsing footprint from prying eyes, without needing to be a network expert or set up complex solutions.
