Last updated: October 2026
#AFFILIATE-PLACEHOLDER-* in our code) until we join programs — at which point every affected page gets a clear, conspicuous disclosure. Full disclosure.
"Just turn on secure DNS and you don't need a VPN" is a common piece of advice. It's half true. Encrypted DNS fixes one leak — the DNS lookup — while a VPN protects the whole connection. Here's what each technology actually does, where they overlap, and when they combine well.
Every time you visit a site, your device asks a DNS resolver to translate the name (example.com) into an IP address. Traditional DNS sends that question in cleartext on port 53 — anyone on the same network path can read it: public Wi-Fi operators, some ISPs, workplace networks, and poorly configured routers (bloggerwalk.com).
That leak happens before your browser's HTTPS connection even starts. HTTPS protects the page content — HTTPS alone does not hide your DNS queries — and switching to a custom resolver like 8.8.8.8 changes who sees the lookups without encrypting them, unless DoH or DoT is explicitly configured (The Droid Guy).
DNS-over-HTTPS (DoH, RFC 8484) wraps DNS queries inside ordinary HTTPS traffic on port 443. Your ISP can't distinguish your DNS lookups from any other web traffic on that port — the queries blend in with everything else (securityboulevard.com).
That camouflage is DoH's real advantage: port 443 is the port every network must leave open for normal browsing, so DoH is harder to block than dedicated DNS channels. This is why it's the right choice on restrictive networks (bloggerwalk.com).
The catch: encryption covers only the query. The moment your browser opens its HTTPS connection, the destination IP and other signals (cleartext SNI in older setups, traffic patterns) can still reveal where you're going (natchecker.com). And whoever runs the resolver you chose still sees every domain you look up — you've moved the trust from your ISP to the resolver (forestvpn.com).
DNS-over-TLS (DoT, RFC 7858) encrypts DNS over a dedicated port 853. The cryptography is the same TLS as DoH, and latency is comparable (DoT adds roughly ~2 ms; DoH adds roughly 4–6 ms because of HTTP framing — forestvpn.com).
The trade-off is the opposite of DoH: port 853 is easy for network operators to identify, monitor, and block — but that same visibility makes DoT easier for an admin to deliberately allow and manage. Rule of thumb: choose DoT for cleaner network management you control; choose DoH when you need DNS to work reliably on networks you don't control (bloggerwalk.com).
| DNS-over-HTTPS (DoH) | DNS-over-TLS (DoT) | |
|---|---|---|
| Port | 443 (blends with web traffic) | 853 (dedicated) |
| Encryption | TLS 1.3 inside HTTPS | TLS 1.3 |
| Blockability | Hard to block without breaking the web | Easy to identify and block |
| Admin visibility | Lower (looks like web traffic) | Higher (dedicated, manageable) |
| Latency overhead | ~4–6 ms | ~2 ms |
| Best for | Roaming users, restrictive networks, consumers | Managed networks, admins who want control |
Table compiled from securityboulevard.com, forestvpn.com, and bloggerwalk.com (2026).
A VPN encrypts all your internet traffic — DNS included — and routes it through the VPN server. When a well-configured VPN handles DNS itself, your lookups travel inside the tunnel and the VPN provider's resolver answers them. Your local network sees neither the query nor the destination: it sees only an encrypted stream to the VPN server (natchecker.com; teamupdraft.com).
| Protection | Plain DNS | DoH / DoT | Full-tunnel VPN |
|---|---|---|---|
| DNS queries encrypted | No | Yes | Yes (inside tunnel) |
| IP address hidden from sites | No | No | Yes |
| Traffic encrypted | No | No (DNS only) | Yes (all traffic) |
| ISP sees where you browse | Fully | Partially (IP + patterns leak) | No (sees only the VPN) |
Table compiled from natchecker.com, teamupdraft.com, and forestvpn.com.
The reverse question matters too: if you have a VPN, do you still need DoH? Not separately. When the VPN routes your DNS through its own resolver inside the tunnel, the queries are already encrypted — and encrypted twice over if DoH runs inside the tunnel. Running both adds latency without real benefit. What matters is that DNS actually goes through the tunnel: that's exactly what our DNS leak explainer and leak test check for.
If you want encrypted DNS on a connection where no VPN is active, the quickest route is your browser's secure-DNS setting — Chrome, Firefox, and Edge all support DoH, each with its own resolver selection. At the OS level, Android's Private DNS and recent Windows/macOS encrypted-DNS options do the same job for all apps, not just the browser (teamupdraft.com; The Droid Guy).
No. Private DNS encrypts only DNS queries, whereas a VPN encrypts all traffic — and a VPN also replaces your IP address from the sites you visit. They can be used together for stronger privacy (forestvpn.com).
For consumer privacy, DoH — it blends into ordinary HTTPS traffic on port 443, which is harder to block and harder to single out for analysis (securityboulevard.com). For a managed network where you want the admin to see and control DNS, DoT is the cleaner choice (bloggerwalk.com).
Only if the encrypted protocol is also enabled. A custom DNS combined with HTTPS does not hide your IP address or fully prevent DNS leakage unless DoH or a similar encrypted protocol is explicitly configured (The Droid Guy).
Yes — DoH queries travel fine inside a VPN tunnel — but it's redundant when the VPN already routes your DNS through its own resolver inside the tunnel. The risk isn't missing DoH; it's DNS bypassing the tunnel, which is a leak (see what a DNS leak is).