DNS Security & Privacy

Every time you visit a website, your device sends a DNS query to translate the domain name into an IP address. By default, these queries travel in plain text — meaning your ISP, network administrator, or an attacker on the same network can see every site you visit. Modern DNS security protocols fix this.

DNS over HTTPS (DoH)

DNS over HTTPS encrypts your DNS queries inside standard HTTPS traffic — the same encryption used when you visit a secure website. This prevents eavesdropping and makes DNS queries harder to block or manipulate.

• How it works: Your browser or OS sends DNS queries to a DoH-enabled resolver (like Cloudflare at https://cloudflare-dns.com/dns-query) over port 443.
• Supported by: Firefox, Chrome, Edge, Safari (limited), Android 9+ Private DNS, and Windows 11.
• Best providers: Cloudflare (1.1.1.1), Google (dns.google), NextDNS, Quad9.

DNS over TLS (DoT)

DNS over TLS encrypts DNS queries using TLS on port 853. Unlike DoH, DoT uses a dedicated port which makes it easier for network administrators to identify — but it still protects query contents from interception.

• Android Private DNS uses DoT under the hood when you enter a provider hostname like one.one.one.one.
• Supported by: Android 9+, many Linux distributions via systemd-resolved, and router firmware like OpenWrt.

DNSSEC (DNS Security Extensions)

DNSSEC adds cryptographic signatures to DNS records, ensuring the response you receive hasn't been tampered with. It protects against DNS spoofing and cache poisoning attacks where attackers redirect you to fake websites.

• DNSSEC validates that the IP address returned actually belongs to the domain you requested.
• Most major public DNS resolvers (Google, Cloudflare, Quad9, OpenDNS) validate DNSSEC automatically.
• DNSSEC protects integrity but does not encrypt queries — combine it with DoH or DoT for full protection.

DNS Privacy Best Practices

Your DNS provider can log every domain you visit. Here's how to minimize exposure:

• Choose a no-log DNS provider — Cloudflare, Quad9, and Mullvad publicly commit to minimal logging.
• Enable encrypted DNS — Use DoH or DoT so your ISP can't see your queries even if they wanted to.
• Avoid unknown DNS services — Free DNS servers from untrusted sources may log and sell your browsing data.
• Use a VPN for full privacy — DNS encryption alone doesn't hide your IP address; a VPN covers both.
• Check for DNS leaks — After changing DNS, run an online DNS leak test to verify your queries go to the intended resolver.

Common DNS Threats

DNS Hijacking

Attackers redirect your DNS queries to a malicious server, sending you to fake banking or login pages. Using a trusted public DNS with DNSSEC validation helps prevent this.

DNS Spoofing / Cache Poisoning

An attacker injects false DNS records into a resolver's cache. DNSSEC-signed responses make this attack much harder to execute successfully.

ISP DNS Logging

Many ISPs log DNS queries and may share data with advertisers or government agencies. Switching to a privacy-focused resolver and enabling DoH prevents this.

DNS-Based Content Filtering

Some DNS providers block malicious, adult, or advertising domains at the DNS level — before your browser even connects. This is sometimes called DNS filtering or DNS firewall:

• Cloudflare 1.1.1.2 — Blocks malware and adult content
• Quad9 (9.9.9.9) — Blocks known malicious domains via threat intelligence
• AdGuard DNS — Blocks ads and trackers network-wide
• CleanBrowsing — Family-friendly filtering with multiple protection levels
• OpenDNS Family Shield — Blocks adult content (208.67.222.123 / 208.67.220.123)