DNS

A resolver (also called a recursive resolver) does the lookup work for you: it asks the root, top-level-domain and authoritative name servers in turn and hands back the final answer. Your device normally uses whichever resolver the network gives it, which at home is usually your internet provider's.

Lookup data has commercial value. A 2021 staff report by the US Federal Trade Commission found that two of the six large providers it studied use web browsing information to target ads, and a third reserves the right to (FTC). Courts in several European countries also order internet providers to block sites, and have begun to extend those orders to public resolvers (see blocking orders).

Encryption protocols

• DNS over HTTPS (DoH) sends queries inside ordinary HTTPS on port 443, so they look like web traffic and are hard to block selectively. Several resolvers now also offer it over HTTP/3.
• DNS over TLS (DoT) wraps queries in TLS on port 853. It is what Android's Private DNS setting uses. Its dedicated port makes it easy for a network to block.
• DNS over QUIC (DoQ) is a newer standard that runs over the QUIC transport, also on port 853 (RFC 9250, 2022). Quad9, AdGuard DNS and Control D offer it.
• DNSCrypt is an older protocol, developed outside the IETF, that encrypts and authenticates queries. Its Anonymized DNSCrypt mode passes queries through a relay so the resolver does not learn your IP address (DNSCrypt project).
• Oblivious DoH (ODoH) applies the same idea to DoH: a proxy sees your IP address but not the query, and the resolver sees the query but not your IP address (RFC 9230, an experimental specification). Apple's iCloud Private Relay uses it.

Other terms you will see

• DNSSEC lets a resolver check that an answer was signed by the domain owner and has not been altered. It authenticates answers; it does not encrypt anything.
• QNAME minimisation means the resolver tells each upstream server only the part of the name it needs (for example, only .org to the root servers) instead of the full domain.
• EDNS Client Subnet (ECS) passes part of your IP address to a domain's name servers so content delivery networks can pick a server near you. It can speed up some sites at a cost in privacy; privacy-focused resolvers leave it off or make it optional.

• The resolver sees everything your provider used to see. Every domain you look up, plus your IP address, now goes to the resolver operator. Choose one by what it keeps, who owns it and which courts can compel it.
• The addresses you connect to. After the lookup, your device connects to an IP address your provider can see. For a site on its own server the address alone identifies it; behind a large content delivery network, many sites share each address.
• The site name in the TLS handshake. Most HTTPS connections still send the site name unencrypted at the start, in a field called SNI (Server Name Indication). Encrypted Client Hello (ECH), published as RFC 9849 in March 2026, hides it, but only when both browser and site support it. Cloudflare turns ECH on by default for sites on its free plan, so observers see only cloudflare-ech.com (Cloudflare docs).
• ECH depends on encrypted DNS. Browsers fetch a site's ECH key through DNS. A network that controls your plain DNS can drop those records and quietly switch ECH off, as Cloudflare's own documentation describes for Chrome and Firefox.
• Apps that bring their own resolver. Browsers have a secure DNS setting that overrides the system one, and some apps and devices ignore the system setting entirely. A system-wide setting does not cover them.
• A VPN usually replaces your DNS settings. While connected, a VPN app normally sends lookups to the VPN's own resolver inside the tunnel; Apple documents this behaviour for its platforms (WWDC20). That is usually what you want; see the VPN guide.
• Encrypted DNS is not anonymity. It hides lookups from the network, not your identity from the sites you visit. For anonymity use Tor Browser, which resolves names inside the Tor network (see the browser guide).

These services work well and some have useful features, but each involves a trade-off in jurisdiction, transparency or blocking that you should weigh first.

Most systems can use encrypted DNS without extra software (see setting it up). These tools add local blocklists, per-app control, or protocols the system lacks, such as DNSCrypt and Oblivious DoH.

A resolver or filter on your own hardware keeps your lookup history at home and covers every device on the network, including ones where you cannot install software. There are two common set-ups, with different trade-offs:

• Forwarding. The local filter blocks what it should and passes everything else to a public resolver. Use an encrypted upstream (DoT, DoH or DoQ) so your provider cannot read the queries; the upstream resolver still sees them.
• Recursive. The local server (Unbound, or Technitium in recursive mode) asks the authoritative name servers itself, so no single company sees your full history. Those queries leave your network unencrypted and from your own IP address, so your internet provider can read them.

Public resolvers used to be an easy way around blocks imposed on internet providers. Since 2021, rights holders in Europe, mostly music labels and sports broadcasters, have taken the resolvers themselves to court to make them block piracy domains. The situation as of October 2026:

• Germany. Sony Music obtained an order against Quad9 in 2021. Quad9 lost the early rounds, then won on appeal at the Higher Regional Court of Dresden in December 2023, which found that a resolver is a neutral intermediary. The ruling is final (TorrentFreak).
• France. At the request of Canal+, Paris courts ordered Cloudflare, Google and Cisco (2024) and Quad9 (December 2024) to block named domains. Cisco withdrew its OpenDNS resolver from France rather than comply, and in March 2026 the Paris Court of Appeal rejected the appeals of all three (TorrentFreak). Quad9 applied its order worldwide, then announced it will stop serving France on 24 November 2026 after losing a penalty case brought by beIN Sports (TorrentFreak).
• Belgium. An order obtained by DAZN requires Cloudflare, Google and OpenDNS to block pirate football streams. Google and Cloudflare complied; a Brussels court upheld the order in August 2026, and Cisco has said it will withdraw OpenDNS from Belgium again (TorrentFreak).
• Italy. The Piracy Shield system was extended to DNS providers and VPNs. Cloudflare refused to filter through 1.1.1.1, and the regulator AGCOM fined it about €14.2 million in early 2026; Cloudflare is appealing (TorrentFreak).
• DNS4EU applies court-ordered blocks to all of its variants, including the unfiltered one, and publishes the orders (DNS4EU).

Orders are issued country by country, but a resolver that cannot reliably tell where its users are may block for everyone or leave the country altogether. Quad9 says it will never block a domain in a way that hides the fact, and lets you search its blocked domains on its website.

• Android 9 and later. Open Settings, then Network & internet, then Private DNS (the exact path varies by manufacturer) and enter the resolver's DNS-over-TLS hostname, for example dns.quad9.net. With a hostname set, Android does not fall back to unencrypted DNS; if the server cannot be reached, it reports no internet access (Android Developers).
• iPhone, iPad and Mac. Install an encrypted DNS configuration profile from your resolver (Quad9, AdGuard DNS and Control D publish them) or an app that sets encrypted DNS, then select it in the DNS settings under General. A connected VPN takes precedence (Apple, WWDC20).
• iCloud Private Relay. Private Relay normally sends lookups through Oblivious DoH, but an encrypted DNS profile you installed takes priority. A plain DNS server typed into network settings is not used for Private Relay traffic (Apple).
• Windows 11 and Windows Server 2022. In network settings, edit the DNS server assignment, enter the resolver's addresses and choose Encrypted only (DNS over HTTPS). Windows recognises Cloudflare, Google and Quad9 addresses; add others with the Add-DnsClientDohServerAddress PowerShell command. Avoid the "encrypted preferred" option, which falls back to plain DNS without telling you (Microsoft).
• Linux with systemd-resolved. In /etc/systemd/resolved.conf set DNS=9.9.9.9#dns.quad9.net and DNSOverTLS=yes. The part after # is used to check the server's certificate. The default is no, and opportunistic mode can be downgraded by an attacker (man page). For DoH or DNSCrypt, run dnscrypt-proxy instead.
• Browsers. Firefox and Chromium-based browsers have their own secure DNS setting. It applies only to the browser and overrides the system resolver, so either set the same resolver in both or leave the browser on the system default.
• The whole network. Point your router's DHCP settings at a Pi-hole, AdGuard Home or Technitium server so every device uses it, and give that server an encrypted upstream.

• Check your set-up. After changing settings, run a leak test such as dnsleaktest.com or Mullvad's connection check and confirm that only the resolver you chose appears.
• Do not mix resolvers. Setting a private resolver as primary and your provider's or Google's as secondary sends some lookups to each, so both see part of your history.
• Prefer strict modes. Settings that only "prefer" encryption fall back to plain DNS silently when encryption fails, and an attacker on the network can make it fail.
• Keep local names local. Devices constantly look up names that only mean something on your home network, such as printer names and reverse lookups of 192.168.x.x addresses. Sent to a public resolver, they reveal your network layout. A local resolver answers them at home, and Quad9 now answers them itself (Quad9).
• Let your VPN handle DNS while connected. Keep the VPN app's own DNS (and its blocklists, if it offers them) rather than forcing a different resolver through the tunnel; see the VPN guide.
• Update self-hosted software. Pi-hole and Unbound both shipped large batches of security fixes in 2026. Do not expose a home resolver to the internet, where strangers can use and abuse it.
• Blocklists are not a privacy guarantee. DNS blocking misses trackers served from the same domain as the site and does nothing about browser fingerprinting; use a hardened browser too (browser guide).
• Have a fallback. Court orders can force a resolver to block in your country or leave it, as Quad9 is doing in France (see blocking orders).

• Privacy Guides: DNS resolversprivacyguides.orgCommunity-maintained comparison of resolvers and encrypted DNS clients.
• RFC 9849: TLS Encrypted Client Hellorfc-editor.orgIETF standard, March 2026: how ECH hides the site name in the TLS handshake.
• RFC 9230: Oblivious DNS over HTTPSrfc-editor.orgExperimental specification, June 2022.
• Pi-hole documentation: Unbound as a recursive resolverdocs.pi-hole.netSet-up steps and caveats for resolving at home.
• A Look at What ISPs Know About Youftc.govUS Federal Trade Commission staff report on six large internet providers, October 2021.
• Farewell, Francequad9.netQuad9, October 2026: why a public resolver chose to leave a country rather than block domains.
• iCloud Private Relay overviewapple.comApple, December 2021, including how Private Relay handles DNS.