DNS over HTTPS vs VPN: Do You Need Both?

Two terms keep turning up in privacy settings: DNS over HTTPS and VPN. They sound as if they do the same job, and some settings pages even describe both as "encrypting your connection". They are related, but they cover different parts of what happens when you open a website. Mixing them up leads to two opposite mistakes: thinking that an encrypted DNS setting makes a VPN unnecessary, or thinking that a VPN makes every DNS setting irrelevant.

This article explains what DNS over HTTPS (DoH) and DNS over TLS (DoT) actually protect, what a VPN protects, where they overlap, and how they behave together on an Android phone and in a web browser. By the end you should be able to decide whether you want one, the other or both, and know how to test it.

What DNS reveals about you

Before a browser can load a page, it must turn a name such as example.com into an IP address. That is the job of the Domain Name System. Your device sends a question, called a query, to a DNS resolver, and the resolver sends back an answer. If you want the full background, read how DNS works or the general explanation from Cloudflare Learning.

In its traditional form, DNS is not encrypted. Queries usually travel over port 53 as readable text. Anyone who can see the traffic between you and the resolver, such as the owner of a public Wi-Fi network or your internet provider, can read the list of names you ask about. They do not see the pages you load or what you type into them, but a list of domains over a day says quite a lot about someone's habits.

That is the problem DoH and DoT were designed to solve. They do not change what DNS is for. They add encryption to the conversation with the resolver.

How DoH and DoT work

DNS over HTTPS is defined in RFC 8484. Your device or browser sends the DNS query as an HTTPS request to a resolver. To an outside observer it looks like ordinary encrypted web traffic on port 443, and its content is not visible. DoH is commonly built into browsers, and some operating systems offer it too.

DNS over TLS is defined in RFC 7858. It wraps the DNS query in a TLS session, the same encryption layer used by HTTPS, but on a dedicated port, normally 853. That makes it easy for a network to see that DNS over TLS is in use, though not what is inside. DoT is common at the operating-system level, and Android's Private DNS setting uses it.

	DNS over HTTPS (DoH)	DNS over TLS (DoT)
Standard	RFC 8484	RFC 7858
Typical port	443, same as web traffic	853, dedicated
What it encrypts	The query and answer between you and the resolver	The query and answer between you and the resolver
Where it is usually set	Inside a browser, sometimes in the operating system	In the operating system, such as Android Private DNS
Can a network tell it is in use?	Harder, since it resembles web traffic	Easier, because of the dedicated port

Both do the same essential thing. They stop the local network from reading your DNS questions in transit. They do not remove the resolver from the picture: the DNS provider you choose still sees every query you send. You are shifting trust from the network's default resolver to the one you picked, and it is wise to know who that is.

What encrypted DNS does not hide

Encrypted DNS is easy to over-credit. After a lookup, your device still connects to the website's IP address, and the network can see that address. The site name may also appear in other parts of the connection set-up, depending on the website and the protocol versions involved. Traffic volume and timing remain visible. And your own IP address is unchanged, so the sites you visit still see it.

What a VPN does with DNS

A VPN builds an encrypted tunnel between your device and the VPN provider's server, and sends your traffic through it. Which traffic depends on the setup, but in the usual full-tunnel configuration it includes your DNS queries, your web requests, and the traffic of other apps. The local network sees an encrypted connection to the VPN server and little more. Websites see the VPN server's address instead of your own. What a VPN does and does not protect covers the ground in more detail.

For DNS, there are two common arrangements:

• The VPN supplies its own DNS resolver, and your queries go through the tunnel to it. The local network cannot read them, but the VPN provider can, so you are trusting that provider with the same position a DNS provider would hold.
• The VPN lets another resolver handle the queries, for example the one set in your operating system or browser. The queries still travel inside the tunnel if the whole device is routed through it.

A well-behaved VPN avoids sending DNS queries outside the tunnel. When that fails, it is called a DNS leak, and you can test for it.

DoH, DoT and VPN side by side

	DoH / DoT	VPN
Encrypts DNS lookups	Yes	Yes, when DNS goes through the tunnel
Encrypts other traffic	No (see HTTPS vs VPN for what HTTPS already covers)	Yes, between device and VPN server
Changes the IP address websites see	No	Yes, to the VPN server's address
Hides your DNS queries from the local network	Yes	Yes
Who can still read your DNS queries	The resolver you picked	The VPN provider, or the resolver it uses
Typical use	Everyday privacy on a trusted device or home network	Untrusted networks, travel, or when you want a different visible IP
Cost and setup	Usually a free setting	A service from a provider

The right-hand column is wider in scope; the left-hand column is lighter and always available. They are not rivals. They answer different questions.

Do you need both?

It depends on what you are trying to protect and from whom. A simple way to decide is to work through typical situations.

1. At home on your own router. Your main concern might be your internet provider seeing every DNS lookup. Encrypted DNS closes that gap cheaply. A VPN would hide more, but you would also be adding a company that now sees what the provider saw before.
2. On public Wi-Fi in a cafe, hotel or airport. You cannot trust the network. Encrypted DNS stops the network from reading your lookups, which is useful, but it leaves the rest of your traffic as it was. HTTPS protects most of that, though not everything, and a VPN adds a layer across all apps. This is the case where using both is easy to justify. The same logic applies to any public network you do not control.
3. When you just want a different visible IP. Only a VPN does that. Encrypted DNS cannot change what a website sees.
4. When a VPN is already on. You usually do not need to add anything for DNS, as long as the VPN keeps lookups inside the tunnel. You can check that with a leak test. Extra DNS settings are not harmful, but they can make it unclear which resolver is in use.
5. When the VPN is off for some apps. If you use split tunneling or switch the VPN off for certain sites, encrypted DNS in your browser or system still protects those lookups.

The short answer is that encrypted DNS is a sensible default, and a VPN is an extra layer for networks or situations you trust less. Neither should be treated as a promise of anonymity.

Android Private DNS and VPN apps

Android has had a system-wide encrypted DNS option called Private DNS since Android 9. It is based on DNS over TLS, so queries from every app on the phone can be encrypted without installing anything. The exact menu names vary by manufacturer, but you can usually find it by searching Settings for "Private DNS", often under Network and internet.

There are three modes:

• Off. DNS is not encrypted by this feature.
• Automatic. The phone tries encrypted DNS with the network's DNS server and falls back to plain DNS if it cannot.
• Private DNS provider hostname. You enter the hostname of a resolver. The phone connects only if that resolver supports DNS over TLS, and otherwise lookups fail. This is the strictest mode.

When a VPN is connected, three things deserve attention:

• Your DNS requests normally travel inside the VPN tunnel, which already hides them from the local network.
• Whether the VPN uses its own DNS servers, or the system's, depends on the VPN app, and how Private DNS and a VPN interact can differ between Android versions and manufacturers. Do not assume.
• If you choose a strict Private DNS hostname and lookups suddenly fail with the VPN on, the VPN's DNS setup may not be compatible. Switching to Automatic, or testing with Private DNS off, will tell you which part is causing the problem.

A practical approach: leave Private DNS on Automatic, or set a provider you trust for use when the VPN is off, and rely on the VPN's tunnel when it is on. Then run a DNS leak test in both states. If you use XPASS on Android, the Android setup guide explains how to install the VPNclient app and sign in with the username and password shown on your My Pass page, and Google's own page on connecting to a VPN on Android covers the system side.

Browser DNS settings and a VPN

Browsers such as Firefox and Chrome can use DoH on their own, independently of your operating system. In the settings it is often called "secure DNS". When it is on, the browser may send lookups to the provider you selected, or to one picked automatically, instead of using the system resolver.

With a VPN connected, this has some effects worth knowing about:

• The queries stay encrypted. They are sent over HTTPS to the DoH provider, and, with the VPN on, that HTTPS connection travels through the tunnel.
• The resolver can differ from the VPN's. The DoH provider sees your queries, coming from the VPN server's address. The VPN's own resolver may not see them at all.
• Leak tests may look different. A test run in the browser may list the DoH provider's servers instead of the VPN's. That is not necessarily a leak to your internet provider, but it is not what you expected either.
• Only the browser is affected. Other apps continue to use the system or VPN resolver.

If you want one resolver to handle everything, choose it deliberately: either let the VPN handle DNS and turn the browser's secure DNS off, or keep the browser setting and accept that browser lookups take a different path. Neither is wrong; the aim is to know which is in use. The help guide on checking if your VPN is working walks through a leak test.

Three examples

A student on campus Wi-Fi. Ploy uses a laptop on university Wi-Fi. She turns on secure DNS in her browser, so the campus network cannot read her lookups. She knows the campus network still sees which addresses she connects to, so she does not rely on it for anything sensitive. For banking at a cafe she adds a VPN as a second layer.

A traveller using Android. Karim lands in a new city and connects to the airport network. He leaves Private DNS on Automatic and turns on his VPN. The VPN covers all his apps. He runs a quick DNS leak test and sees that the lookups go through the tunnel, not his usual provider.

A remote worker at home. Nong works from a home router. She sets encrypted DNS on the router and the laptop, because the main exposure is her internet provider reading lookups. She turns on a VPN only when she works from other places. She also understands that the resolver she chose can see her lookups, so she picks one whose privacy information she has read.

Common mistakes and limits

• Assuming DoH replaces a VPN. It protects lookups only. Your IP address and the connection itself remain visible to the network.
• Assuming a VPN makes browser DNS settings irrelevant. They can change the resolver that actually answers.
• Setting a strict Private DNS hostname and then blaming the VPN when lookups fail. Test with Private DNS off.
• Believing encrypted DNS means anonymity. The resolver sees your queries, and sites see your IP address.
• Running several DNS tweaks at once. Change one setting at a time and test, so you know which one helped.
• Skipping the leak test. The settings page tells you what is configured, not what is happening.
• Ignoring the law and terms of use. Neither a VPN nor encrypted DNS is a way around the rules of a network or service you use.
• Forgetting that DNS is one layer. Updates, strong passwords and two-factor authentication matter at least as much.

Summary

DNS over HTTPS and DNS over TLS encrypt your DNS lookups between your device and the resolver, and they do that cheaply and well. A VPN encrypts everything that goes through its tunnel and changes the IP address that sites see, but it asks you to trust the provider. They solve different problems, so they are complementary rather than interchangeable. Use encrypted DNS as a sensible default, add a VPN on networks you trust less, know which resolver answers your queries, and verify with a DNS leak test.

If you want a VPN for those networks, the XPASS pricing page shows how a fixed-length pass works, with no automatic renewal.