What encrypted DNS actually is
DNS is the internet's address book, and for most of its history it was sent in the clear. Encrypting it changes who can read your lookups. It does not make them disappear.
The problem it solves
Every time a device loads anything, it asks a resolver to turn a name into an address. Traditionally that question travelled unencrypted, so anyone between you and the resolver — your network operator, your ISP, whoever runs the café Wi-Fi — could read every site you were about to visit.
DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) wrap that question in the same encryption a website uses. The observer now sees an encrypted conversation with a resolver, not a list of the sites you asked for.
What it does not do
This is where most explanations get vague, so plainly:
- Your resolver still sees everything. Encryption protects the path, not the destination. You are choosing who to trust, not removing trust from the equation.
- It is not a VPN. Your traffic still goes where it was going, from your address.
- The connection itself is still visible. An observer cannot read the lookup but can often infer the destination from the connection that follows.
DoH or DoT?
| DoH | DoT | |
|---|---|---|
| Port | 443, shared with web traffic | 853, dedicated |
| Blends in | Yes — looks like HTTPS | No — identifiable port |
| Easy to block | Hard | Simple |
| Typical use | Phones, browsers, apps | Routers, network-wide |
Apple devices support both through a configuration profile. Most routers do DoT more readily. The practical difference is that DoH is harder for a network to block, which is a feature or a nuisance depending on which side of the network you are on.
How DNSight uses it
Each device gets its own encrypted endpoint. That is what makes per-device identity possible — the resolver can tell the iPhone from the TV because they arrive on different addresses, without inspecting any traffic. Filtering and the timeline both follow from that, and both keep working on cellular data because the endpoint travels with the device.
Common questions
- Is encrypted DNS the same as a VPN?
- No. A VPN moves all of your traffic through another network. Encrypted DNS only protects the lookups, and your traffic still goes directly from your own address.
- Does my ISP still see what I visit?
- It can no longer read your lookups, but it still sees the connections you make afterwards and can often infer destinations from them.
- Why does the DoH URL show an error in my browser?
- Because it is a resolver endpoint, not a web page. It speaks DNS. Paste it into a DNS setting instead.
- Does encrypted DNS slow things down?
- Not noticeably. Connections are reused, and filtered lookups fail fast rather than fetching anything.
See it on your own device
Point one device at DNSight and get a timeline you can actually read. Works on phones, laptops, TVs and routers, on Wi-Fi, cellular and roaming.