Private DNS

Every time you open a website or an app connects to a server, your device first asks a DNS resolver to turn a domain name into an IP address. By default that resolver usually belongs to your internet provider, and the query travels unencrypted. Private DNS replaces this with a resolver you choose, reached over an encrypted channel, so the network you are on can't read or alter your lookups.

The term covers two related things. In VPN apps, "private DNS" usually means the provider runs its own resolvers and sends all DNS queries to them inside the VPN tunnel. On Android, "Private DNS" is also the name of a system setting (Android 9 and later) that sends lookups to a resolver of your choice using DNS over TLS.

How it works

Plain DNS runs over UDP port 53 with no encryption. Anyone on the path, such as your ISP, the Wi-Fi operator or an attacker on a public hotspot, can see which domains you look up and can send back fake answers. Private DNS fixes this in one of two ways:

• Inside a VPN tunnel. The VPN app sets your device to use the provider's DNS servers, and the queries travel through the same encrypted tunnel as the rest of your traffic. The provider's resolver does the lookup, so your ISP only sees encrypted VPN traffic.
• Encrypted DNS protocols. DNS over TLS (DoT, port 853) and DNS over HTTPS (DoH, port 443) encrypt each query between your device or browser and the resolver. These work without a VPN.

Why it matters

The main reason is DNS leaks. Even with the VPN on, a badly configured app or operating system can keep sending lookups to the ISP's resolver. Your traffic is hidden but your browsing history is not. A VPN that runs its own DNS and forces every query through the tunnel closes that gap.

Private DNS also stops DNS hijacking, where an ISP or hotspot redirects mistyped or blocked domains to its own pages. It gets around simple DNS-based blocking of websites. Some providers also filter ads, trackers and malicious domains at the resolver level.

Limits and risks

• You move trust, you don't remove it. The resolver operator still sees every domain you look up. With a VPN, how private this is depends on the provider's no-logs policy and whether it has been audited.
• Encrypted DNS alone doesn't hide where you go. Without a VPN, your ISP still sees the IP addresses you connect to, and often the site name in the TLS handshake (SNI), unless the site supports Encrypted Client Hello.
• Settings can conflict. An OS-level private DNS setting, a browser's built-in DoH or a custom DNS on the router can override or bypass the VPN's resolver. Some VPN apps tell you to turn these off.
• Leaks during reconnects. If the tunnel drops, queries can fall back to the ISP resolver unless a kill switch blocks traffic.
• Split tunneling side effects. Apps excluded through split tunneling may use the regular DNS, which is expected but worth knowing.

What to check when comparing tools

• Whether the provider runs its own resolvers or forwards queries to a third-party DNS service.
• Whether DNS logging is covered by the no-logs policy and by an independent audit.
• Built-in DNS and IPv6 leak protection on every platform you use, not only on desktop.
• Whether the app supports DoH or DoT for its resolvers, or only plain DNS inside the tunnel.
• Optional DNS filtering for ads, trackers and malware, and whether you can switch it off.
• Whether you can set a custom DNS server if you prefer your own resolver.

After connecting, run a DNS leak test. The only resolvers listed should belong to your VPN provider or the service you picked.

Related terms

Private DNS vs Smart DNS: Smart DNS sends selected lookups to proxy servers to unblock streaming catalogues. It has no encryption and doesn't hide your IP. DoH vs DoT: both encrypt DNS. DoT uses its own port and is easy for networks to spot or block. DoH blends in with normal HTTPS traffic.