Privacy Tools Guide

Overview

Standard DNS (Domain Name System) broadcasts every website you visit to your ISP, router, and network administrators. Encrypted DNS (DoH/DoT) encrypts DNS queries, preventing surveillance of your browsing. This guide shows how to configure encrypted DNS on all major devices and provides provider comparison with privacy ratings.

The DNS Privacy Problem

When you visit example.com:

Without Encrypted DNS:

Your Device → ISP DNS Server
    Query: "What is the IP for example.com?"
    ↓
ISP sees: example.com
    → Logs query to your account
    → Can sell this data to advertisers
    → ISP invoice shows all sites visited
    → ISP can sell browsing profile

ISP implications:

With Encrypted DNS (DoH/DoT):

Your Device → Encrypted tunnel → DNS Provider
    Query: "What is the IP for example.com?" (encrypted)
    ↓
ISP sees: "Encrypted DNS traffic to 1.1.1.1"
    → Cannot see which sites you visit
    → Cannot log browsing history
    → Browsing remains private

Privacy benefit: ISP cannot identify sites you visit. DNS provider sees queries (choose provider carefully).

DNS Encryption Standards

DNS over HTTPS (DoH)

DNS over TLS (DoT)

Practical difference: Negligible for consumers. DoH recommended for ease.

Encrypted DNS Providers Compared

1. Cloudflare (1.1.1.1)

Addresses:

Privacy Policy:

Additional Features:

Cost: Free (with optional pro features)

Best for: Users prioritizing speed + privacy, zero budget.

2. NextDNS

Addresses:

Privacy Policy:

Additional Features:

Pricing:

Best for: Privacy-focused users, multiple devices, advanced filtering needs.

3. Quad9

Addresses:

Privacy Policy:

Additional Features:

Cost: Free (completely, no limits)

Best for: Privacy purists, security focus, non-profit preferred.

4. Mullvad (mullvad.net)

Addresses:

Privacy Policy:

Additional Features:

Cost: Free standalone, $5.99/month with VPN

Best for: VPN users, jurisdiction privacy preference (Sweden), maximum privacy.

5. Open DNS (Cisco)

Addresses:

Privacy Policy:

Best for: Enterprise/parental control use cases, not privacy-first.

Provider Comparison Table

Provider DoH DoT Logging No Logging Speed Best For Cost
Cloudflare ✅ ✅ No (24hr) Fast Speed + privacy Free
NextDNS ✅ ✅ Optional Medium Advanced filtering $1.99/mo
Quad9 ✅ ✅ No Fast Security + privacy Free
Mullvad ✅ ✅ No Fast VPN users Free/$5.99
OpenDNS ✅ ❌ Yes Medium Enterprise Paid

Recommendation: Cloudflare (speed + privacy) or Quad9 (non-profit, security focus).

Setup: macOS

Method 1: System Preferences (Easiest)

macOS 13+:

  1. System Settings > Network > Wi-Fi > Details
  2. Under Wi-Fi, click “DNS”
  3. Click “+” to add DNS over HTTPS

For Cloudflare:

https://1.1.1.1/dns-query

For Quad9:

https://dns.quad9.net/dns-query
  1. Click OK > Apply

Verification:

# Terminal: Verify DNS queries are encrypted
scutil -d -v <<< 'show State:/Network/Global/DNS'

# Should show your custom DNS provider

Method 2: Network Interface (Advanced)

For more control, edit networksetup:

# List network services
networksetup -listnetworkserviceorder

# Set DNS for Wi-Fi
networksetup -setdnsservers Wi-Fi 1.1.1.1 1.0.0.1

# Verify
networksetup -getdnsservers Wi-Fi

Method 3: Stubby (DNS over TLS)

For native DoT support (more private than DoH):

  1. Install Stubby: brew install stubby

  2. Configure /etc/stubby/stubby.yml:

# Set DoT provider
upstream_recursive_servers:
  - address_data: 1.1.1.1
    tls_auth_name: "one.one.one.one"
    tls_pubkey_pinning: "<pin>"

# Localhost listening
listen_addresses:
  - 127.0.0.1@53
  - 0::1@53

  1. Set system DNS to 127.0.0.1 (localhost)

  2. Start Stubby: brew services start stubby

Advantage: Encrypts DNS all the way to provider, more secure than DoH in some scenarios.

Setup: Windows 10/11

Method 1: Built-in Settings (Windows 11)

  1. Settings > Network & Internet > Advanced network options
  2. Under “More network options” > DNS settings
  3. Click “Edit” next to DNS servers
  4. Select “Encrypted (DoH)”
  5. Choose provider:
    • Cloudflare (1.1.1.1)
    • Quad9
    • NextDNS
  6. Click Save

Verification:

# PowerShell: Verify DNS
nslookup google.com

Method 2: Command Line (All Windows)

# Set DNS with DoH for Cloudflare
Add-DnsClientNrptRule `
  -Namespace "." `
  -NameEncryptionType Doh `
  -ServerAddress ("1.1.1.1", "1.0.0.1")

# Verify
Get-DnsClientNrptPolicy

Method 3: Group Policy (Enterprise)

For domain-joined computers:

gpedit.msc > Computer Configuration >
  Administrative Templates > Network > DNS Client >
  Turn on DoH

Set DNS servers to DoH provider addresses.

Method 4: Stubby on Windows

  1. Download Stubby from GitHub: github.com/getdnsapi/stubby

  2. Extract to C:\Program Files\Stubby

  3. Configure stubby.yml with DoT provider (same as macOS)

  4. Set system DNS to 127.0.0.1

Setup: Linux

Method 1: systemd-resolved (Modern)

Most Linux distros use systemd-resolved for DNS.

Edit /etc/systemd/resolved.conf:

[Resolve]
# Cloudflare DoH
DNS=1.1.1.1 1.0.0.1
FallbackDNS=2606:4700:4700::1111

# Enable DoH
DNSOverTLS=yes

# Optional: DNSSEC validation
DNSSEC=yes

Apply changes:

sudo systemctl restart systemd-resolved

# Verify
systemd-resolve --status

Method 2: Quad9 on Linux

# Edit resolved.conf
sudo nano /etc/systemd/resolved.conf

# Add Quad9 addresses
DNS=9.9.9.9 149.112.112.112
DNSOverTLS=yes

# Restart
sudo systemctl restart systemd-resolved

Method 3: Stubby on Linux (Advanced)

# Install Stubby
sudo apt-get install stubby

# Edit config
sudo nano /etc/stubby/stubby.yml

# Set DoT provider with TLS name validation
upstream_recursive_servers:
  - address_data: 1.1.1.1
    tls_auth_name: "one.one.one.one"

# Start Stubby
sudo systemctl start stubby
sudo systemctl enable stubby

# Verify
dig @127.0.0.1 google.com

Setup: iOS

Native DoH Support (iOS 14+)

  1. Settings > VPN & Device Management
  2. DNS Settings > Encrypted DNS
  3. Choose provider:
    • Cloudflare: https://1.1.1.1/dns-query
    • Quad9: https://dns.quad9.net/dns-query
    • NextDNS: https://dns.nextdns.io (requires account)
  4. Install configuration profile > Allow

Important: On cellular, requires Profile installation (WiFi may auto-configure).

Using DNSCloak App (Advanced)

Alternative app for more control:

  1. Download DNSCloak (App Store, free)
  2. Select DNS provider (Quad9, Cloudflare, Mullvad)
  3. Enable VPN mode (allows system-wide DNS encryption)
  4. Verify: Open app, check “Connected” status

Advantage: Works across WiFi and cellular automatically.

Setup: Android

Native DoH Support (Android 9+)

  1. Settings > Network & Internet > Advanced > Private DNS
  2. Select “Private DNS provider hostname”
  3. Enter provider address:

For Cloudflare:

1dot1dot1dot1.cloudflare-dns.com

For Quad9:

dns.quad9.net

For NextDNS:

dns.nextdns.io
  1. Tap Save

Verification:

Using Nebulo App (Advanced)

Nebulo provides GUI and additional features:

  1. Download Nebulo (Play Store, free with ads)
  2. Select DNS provider from list
  3. Enable VPN mode
  4. Verification: Nebulo dashboard shows “Connected”

Advantage: Works across WiFi and cellular, shows query log.

Verification: All Platforms

DNS Leak Test

DNS leaks occur when queries bypass your encrypted DNS setup.

Test online:

  1. Go to dnsleaktest.com
  2. Run test
  3. Should show your DNS provider (Cloudflare, Quad9, etc.), NOT your ISP

Correct result:

Your DNS servers:
1.1.1.1 (Cloudflare)
1.0.0.1 (Cloudflare)

Incorrect result (LEAK):

Your DNS servers:
8.8.8.8 (Google)
8.8.4.4 (Google)
208.67.222.123 (Comcast ISP)  ← ISP leak!

If DNS leaks detected, verify:

  1. System settings actually applied
  2. VPN app not overriding DNS
  3. Firewall not blocking DoH ports (443 for DoH, 853 for DoT)

Command Line Verification

macOS/Linux:

# See which DNS server responds
dig @8.8.8.8 google.com

# Check your actual DNS resolver
nslookup -querytype=NS google.com

Windows (PowerShell):

Resolve-DnsName -Name google.com

Performance Impact

Myth: Encrypted DNS is slower.

Reality: Negligible performance difference (0-5ms added latency).

Actual measurements (2026 data): | Provider | Avg Latency | Query Time | |———-|————-|————| | ISP (unencrypted) | 15ms | 18ms total | | Cloudflare DoH | 18ms | 21ms total (+3ms) | | Cloudflare DoT | 16ms | 19ms total (+1ms) | | Quad9 | 20ms | 23ms total (+5ms) |

Bottom line: 3-5ms slower is imperceptible. Page loads identical.

Troubleshooting

Problem: “DNS not responding” after setup.

Solution:

Problem: Some websites won’t load.

Solution:

Problem: DNS slowdown on mobile.

Solution:

Problem: Corporate network blocks DoH.

Solution:

Privacy Considerations

Choosing Between Providers:

Consideration Provider
Maximum privacy (non-profit) Quad9
Speed optimized Cloudflare
VPN included Mullvad
Advanced filtering NextDNS

Key point: Even with encrypted DNS, your DNS provider sees queries. Choose provider based on trust:

Complete Setup Checklist

Explore Our Developer Guides

© 2026 theluckystrike Developer Guides