Encrypted DNS Explained: DoH, DoT and DoQ

Encrypted DNS prevents people operating the network you use from reading your website lookups, but its protection has clear limits. DNS, the Domain Name System, is the mechanism your device uses to ask for the network address associated with a website name. With traditional DNS, that request travels in plain text, which means it is not encrypted and can be read by anyone able to observe it on the network.

That exposure matters on networks you do not fully control. An internet provider or the operator of public Wi-Fi can read which websites your device asks DNS about when those requests are sent in plain text. The lookup is only one part of visiting a website, but it can still reveal where you intend to browse. Encrypted DNS addresses that specific weakness by making the query readable only to your device and the DNS server handling it.

The basic idea is similar to the protection represented by the padlock shown for an encrypted website connection. Instead of allowing a DNS query to cross the network as readable information, an encrypted DNS protocol wraps it in encryption while it travels between the device and DNS server. The three main approaches are DNS over HTTPS (DoH), DNS over TLS (DoT) and DNS over QUIC (DoQ). They protect the same kind of request, but carry it in different ways.

DoH places DNS queries inside HTTPS, the encrypted protocol commonly used for website connections. It uses port 443, a numbered network entry point also used by HTTPS traffic. In one line, its defining feature is that DNS is carried inside ordinary encrypted HTTPS traffic rather than over a visibly separate DNS channel.

DoT sends DNS through a dedicated encrypted channel using TLS, or Transport Layer Security, which protects information while it moves between two systems. Unlike DoH, it does not place DNS inside HTTPS traffic. Its simple distinction is separation: DoT provides a channel specifically for encrypted DNS requests.

DoQ carries DNS over QUIC, a newer transport designed for speed. A transport is the underlying method used to move information between devices across a network. The short distinction is that DoQ uses this newer, speed-focused transport, while DoH uses HTTPS and DoT uses its own dedicated encrypted channel.

These protocols protect the DNS query itself, not everything that follows it. Once the lookup has been made, the connection to the requested website is a separate part of the browsing process. Enabling DoH, DoT or DoQ therefore does not encrypt an otherwise unencrypted whole connection, and it does not hide the IP address, the numerical network address used to send traffic to its destination. Encrypted DNS should not be treated as complete anonymity or as protection for every piece of internet activity.

This makes encrypted DNS a real but partial privacy layer. It closes the plain-text DNS gap between a device and its chosen DNS server, preventing an internet provider, public Wi-Fi operator or another observer on that network from simply reading the query in transit. At the same time, it leaves other information outside that protected query, including the IP address and the rest of the connection. Understanding that boundary helps users adopt it for what it does well without expecting protections it does not provide.

To turn it on, first choose a DNS service that supports DoH, DoT or DoQ. Then apply the service's settings on the individual device or on the router, the equipment that connects a home or workplace network to the internet. Device-level setup applies the choice on that device, while router configuration places the setting at the network connection point. The exact option to select is the protocol supported by both the chosen service and the device or router being configured.

For readers considering a private DNS service as part of this protection, AEU DNS offers private, secure DNS for everyone. Whichever service is selected, the important checks are that it supports an encrypted protocol, that the setting has actually been applied to the intended device or router, and that encrypted DNS is understood as one privacy measure rather than protection for the entire connection.