How to Use Secure DNS on Your Router and Devices
Every site you visit starts with a DNS lookup. Here is how to keep those lookups from traveling in plain text.
To use secure DNS, turn on DNS over HTTPS (DoH) or DNS over TLS (DoT) on your router if it supports it, or in your phone, computer or browser. Typing a new DNS server address into your router changes who answers your lookups. On its own, it does not encrypt them.
What is DNS?
DNS turns names like apple.com into IP addresses. Apple says your router uses your internet provider’s DNS server by default, and devices on your network use the server the router gives them.
From the team behind this checker
Want a router that takes this seriously by default?
- SecureRooms. Smart devices live apart from your computers.
- You approve every new device before it joins.
- Rio VPN built in. First year included.
- Set up in about 10 minutes from the app.
$199.99 · 1 year of VPN included, then $7.99/mo · 30-day returns · 1-year warranty. Rio builds this site and grades its own router by the same method.
Why does plain DNS matter?
Cloudflare says DNS queries have traditionally been sent in plaintext, readable by anyone on the network path. They can be monitored, modified or used for tracking.
CISA says unencrypted DNS gives adversaries chances to monitor and sometimes tamper with lookups. Tampering is the idea behind DNS hijacking.
DoH vs DoT: what is the difference?
- DNS over TLS (DoT) is defined in RFC 7858 from 2016. It uses its own port, 853.
- DNS over HTTPS (DoH) is defined in RFC 8484 from 2018. It sends DNS inside normal HTTPS traffic on port 443.
- Both encrypt the lookup between your device and the DNS provider. The provider still sees your lookups, so choose one whose privacy policy you trust.
Should you set it on the router or the device?
- Router. Cloudflare says a DNS setting on the router applies network-wide, so you do not change each phone or computer. But a plain IP address in the router’s DNS field is not encrypted unless the router offers a DoT or DoH option.
- Device or browser. This encrypts lookups from that device, even on other networks. Android added Private DNS, which uses DoT, in Android 9 (Android P). Chrome added Secure DNS, which uses DoH, in Chrome 83. CISA notes macOS has supported both since Big Sur.
- Watch for bypass. CISA warns that encrypted DNS in apps can bypass local DNS settings. That matters if you rely on filtering set at the router.
Which DNS providers support encryption?
Common public resolvers include Google Public DNS (8.8.8.8), Cloudflare (1.1.1.1) and Quad9 (9.9.9.9). Each publishes encrypted options.
Some also filter. Quad9’s standard service blocks malware, and Cloudflare’s 1.1.1.2 blocks known malware. Your internet provider may offer DoH too, since Chrome upgrades to it automatically when your current provider supports it. We do not endorse any provider.
How do you turn on secure DNS?
- Note your current settings first. Google advises writing them down so you can undo changes.
- Check your router for a DoT or DoH option in its internet, WAN or DNS settings. If it has one, enter the hostname your provider lists.
- If not, turn it on per device. Use Private DNS on Android, or the secure DNS setting in your browser or operating system.
- Decide on fallback. Chrome falls back to regular DNS by default if DoH fails. Picking a specific provider switches it to a no-fallback mode. CISA warns that fallback can let attackers force plain DNS.
- Test it. Google says Android marks a network "No internet access" if it cannot reach your Private DNS server.
Does secure DNS make your router secure?
No. It protects lookups in transit. It does not fix weak passwords, unpatched flaws or an end-of-life router. Start with our router checklist, then check your router’s grade.
Frequently Asked Questions
Not by itself. Entering a resolver’s IP address only changes who answers. Encryption needs DNS over TLS or DNS over HTTPS, set on the router if it supports it, or on your devices.
Both encrypt DNS lookups between your device and the provider. DoT uses its own port, 853. DoH runs inside HTTPS on port 443, alongside normal web traffic.
It hides your DNS lookups from others on the network path. Your chosen DNS provider still sees them, so pick one whose privacy policy you trust.
Apple says the names of sites you visit are then unencrypted and could be monitored on the network. It suggests updating software, restarting your device and router, and forgetting and rejoining the network.
It helps on devices that use it. RFC 7858 says TLS removes chances for eavesdropping and on-path tampering. It does not stop someone who controls your router from changing the router’s own settings.
Sources
Dates show when each source was published or when we checked it.
- Apple Support: Recommended settings for Wi-Fi routers and access points (July 14, 2026)
- Cloudflare 1.1.1.1 docs: Encryption (last updated May 5, 2026)
- Cloudflare 1.1.1.1 docs: Router setup (last updated May 1, 2026)
- IETF RFC 7858: Specification for DNS over Transport Layer Security (TLS) (May 2016)
- IETF RFC 8484: DNS Queries over HTTPS (DoH) (October 2018)
- CISA: Encrypted Domain Name System (DNS) Implementation Guidance (April 2024)
- Chromium Blog: A safer and more private browsing experience with Secure DNS (May 19, 2020)
- Google Online Security Blog: DNS over TLS support in Android P Developer Preview (April 17, 2018)
- Google Public DNS: Get started (checked October 8, 2026)
- Quad9: Service Addresses and Features (checked October 8, 2026)
Check your router
See how your router scores
Get its FCC status, CVEs, grade and an action plan.
Check a Router → Top 10 Safe Routers