The problem with plain DNS
Traditional DNS was designed in the 1980s without encryption. Each lookup is sent as an unencrypted packet, usually on port 53. That means the operator of a public Wi-Fi network, your internet provider or an attacker positioned on the network can read the full list of domains you visit. They can also tamper with the answers, redirecting you to a different server than the one you asked for.
For a DNS firewall this matters twice over. Your browsing history is visible to others, and a tampered answer could bypass the filtering you set up.
DNS-over-TLS
DNS-over-TLS, or DoT, sends DNS queries inside an encrypted TLS connection on its own dedicated port, 853. Because the port is distinct, network administrators can easily recognise and manage DoT traffic. Android supports DoT natively through its Private DNS setting, and many routers and firewalls can forward queries over DoT.
DNS-over-HTTPS
DNS-over-HTTPS, or DoH, sends DNS queries as HTTPS requests on port 443, the same port used for normal web traffic. That makes DoH hard to distinguish from other web traffic and difficult to block, which is good for privacy on hostile networks. Modern browsers, Windows, macOS and iOS all support DoH.
Encrypted DNS with FirewallDNS
FirewallDNS is designed to accept encrypted DNS in addition to classic port 53 queries, with a personal DoH or DoT address per device so that filtering follows the device even when its IP address changes. [VERIFY: DoH/DoT endpoints and per-device addresses are described on the site but are not yet visible in the dashboard — confirm availability and addresses before publishing] When available, you will find your encrypted DNS addresses in the dashboard.
What encryption does and does not hide
Encrypted DNS protects the lookup between your device and the resolver. It does not hide which IP addresses you connect to afterwards, and in many cases the name of the site is still visible in the TLS handshake of the actual connection. It also does not hide your lookups from the resolver itself, which is why it matters how the resolver handles logs. Our security page explains how FirewallDNS treats query data.
Encrypted DNS as a bypass risk
Encrypted DNS is a double-edged sword for network filtering. When a browser or app uses its own built-in DoH resolver, its lookups skip your network's DNS firewall entirely. On managed networks, the usual approach is to disable built-in DoH via policy or point it at your filtering resolver, and to block well-known public DoH services at the firewall. Our parental controls page covers this in more detail.
Configuring encrypted DNS on common platforms
On Android, encrypted DNS is set under Private DNS by entering a hostname. On iOS and macOS, DoH and DoT are configured through a configuration profile. Windows 11 supports DoH for DNS servers it recognises, configurable in the network adapter settings. Browsers such as Chrome, Edge and Firefox include their own secure DNS settings where you can enter a custom DoH address. Routers and firewalls vary; our vendor guides note where DoT or DoH forwarding is available.
Wherever you configure encrypted DNS, use the addresses shown in your FirewallDNS dashboard so your filtering settings apply. [VERIFY: where encrypted DNS addresses are shown]
Encryption and the registered IP model
FirewallDNS normally identifies your network by its registered public IP address. Encrypted DNS with a personal address per device is designed to keep filtering working when a device leaves that network, for example a laptop on hotel Wi-Fi. [VERIFY: per-device encrypted DNS availability]
DNS over QUIC and the future
A newer protocol, DNS-over-QUIC (DoQ), carries DNS over the QUIC transport used by HTTP/3, aiming for lower latency than TLS over TCP. Support in operating systems is still limited. [VERIFY: whether FirewallDNS plans DoQ support] For most networks today, DoH and DoT are the practical choices.
Which should you use?
For routers and firewalls, DoT is often the simplest choice where supported, because the dedicated port is easy to manage. For individual laptops and phones, especially when they leave your network, DoH or Android Private DNS keeps filtering active wherever the device goes. Classic DNS on port 53 remains fine inside a trusted network where you control the path to the resolver.