What browser Secure DNS protects, and what it doesn’t
Secure DNS encrypts a browser’s lookup to a resolver, but the resolver still receives it. Learn what Chrome and Firefox protect, how fallback works and when to leave network controls alone.
6 min read
- Author
-
-
- Published
- Reading time
- 6 min
When a browser sends a DNS lookup over Secure DNS, a Wi-Fi operator cannot directly read the question travelling in that encrypted connection to the resolver. That resolver still receives the domain name, and the website still receives your visit. The practical choice is whether you trust the resolver and understand what the browser does if it cannot reach it.
DNS turns a name such as example.com into information a device can use to find a service. DNS over HTTPS (DoH) sends the question and reply through HTTPS, protecting them in transit between the browser and its configured resolver. That can make passive snooping and tampering by an on-path network observer harder, as the DoH standard (RFC 8484) explains.
The steps below follow Google and Mozilla’s published desktop instructions. Exact labels and behaviour can vary with browser versions, device management and network policy.
What Secure DNS changes
A normal DNS lookup can reveal the domain name being requested to systems along the route between your device and its recursive resolver. DoH encrypts that client-to-resolver exchange with HTTPS. It changes the transport for DNS; it does not change what a DNS question means or make every later part of a connection private.
This distinction matters because the resolver is an endpoint, not an invisible courier. It processes the questions it receives and can associate them with the network address visible at the connection; a VPN or proxy can change which address the resolver sees. The IETF’s DNS privacy guidance (RFC 9076) says resolver choice has direct privacy consequences: an encrypted connection does not remove the information available to that resolver.
Who can still see what?
- A Wi-Fi operator or other observer between you and the resolver: DoH protects the DNS message from direct reading or alteration while it travels over the encrypted connection. The observer can still see that your device connects to the resolver, and other traffic clues may reveal information about browsing.
- The resolver you selected: It receives the DNS questions it handles. Its operator may log, retain or correlate those questions under its own practices. Secure transport does not mean “no logs”; check who runs the service and what its privacy policy says.
- The website you open: DoH does not hide the page request, account activity, cookies or other information you send to that site. HTTPS protects the web connection separately; DoH is not a substitute for it.
- Other apps on your PC: A browser setting does not change Windows’ system DNS configuration or automatically change how other software resolves names. Treat browser Secure DNS as a browser-level choice.
DoH by itself is not a malware filter or proof that a DNS answer is trustworthy. It protects the DNS exchange in transit; DNSSEC is a separate mechanism for validating DNS data. RFC 8484 explains that DoH and DNSSEC address different problems.
Automatic mode trades strictness for compatibility
Secure DNS settings differ most when the encrypted resolver is unavailable or a network expects you to use its own DNS service.
In desktop Chrome, open More → Settings → Privacy and security → Security and find Use secure DNS under Advanced. Google says Chrome’s automatic mode can fall back to unencrypted DNS if a lookup fails. Choosing a custom provider prevents that default fallback, so a resolver problem can instead produce a name-lookup error. Chrome also says Secure DNS may be unavailable when a device is managed or parental controls are active. See Google’s Chrome instructions .
In Firefox, open Settings → Privacy & Security → DNS over HTTPS → Advanced settings. Mozilla describes Default Protection as using DoH where available, then falling back to the system resolver when needed. It can also disable DoH when a VPN, parental control, enterprise policy or network signal says not to use it. Max Protection keeps secure DNS on and warns if the selected resolver cannot be reached or has no address for a name; Firefox offers an exception that uses the system resolver. Firefox shows whether DoH is Active, Not active or Off. See Mozilla’s Firefox DoH guide .
These modes are not a “good” and “bad” switch. Automatic or default modes favour compatibility and can permit an unencrypted fallback. A stricter custom mode reduces that fallback, but a resolver outage, local network name or filtering setup can make a site stop resolving.
Choose a setting without surprising yourself
Before changing the provider or protection level, answer three questions:
- Who controls this PC and network? On a work, school or family-managed device, follow the administrator’s or parent’s DNS setup. A local resolver may provide internal names, filtering or access controls. Do not override it just to make a browser setting show “active.”
- Who operates the resolver? Read its current privacy and logging policy. If you do not know the provider or do not trust its operator with your DNS questions, “secure” alone is not a reason to select it.
- What happens if the resolver is unavailable? If compatibility matters most, a default mode may be suitable, with the understanding that it can fall back. If you want to avoid a silent unencrypted fallback, use a stricter mode only after choosing a resolver you trust and accepting that some lookups may fail.
For example, if your family’s filtering depends on the router’s DNS service, switching the browser to a separate provider can change which rules apply. If your browser stops opening a local work site after a provider change, first restore the previous setting or contact the network administrator; a browser’s resolver choice may be the cause.
The useful rule is simple: know which resolver handles the lookup, and know whether the browser can fall back to ordinary DNS. DoH can protect a DNS question while it travels to that resolver. It cannot make the resolver, the destination website or your overall browsing activity invisible.
