Browser Secure DNS and VPN: How They Interact

Modern browsers have a setting, usually called Secure DNS or DNS over HTTPS, that sends your website lookups through an encrypted channel to a resolver the browser chooses. A VPN also changes how your lookups travel. When both are on at the same time, it is not obvious which one wins, who actually sees your lookups, or why a work site or router page suddenly stops opening.

This article is about that interaction only. If you need the basics of the domain name system first, read how DNS works. If you want a broader comparison of encrypted DNS and a full VPN, DNS over HTTPS vs VPN covers it. Here we look at the practical situation on one computer: a browser with its own DNS setting, a VPN with its own DNS handling, and the choices that make them agree.

Two resolvers on one computer

Every lookup starts with a question: which address belongs to this name? On most computers there are two places that can ask it.

• The system resolver. Your operating system keeps a DNS setting, usually received from the network automatically, such as the home router or a hotel. Programs that do not have their own setting use it. When a VPN connects, the VPN software normally replaces or adds DNS servers for the system.
• The browser resolver. With Secure DNS switched on, the browser skips the system setting and talks to a DNS provider it chooses, wrapped in HTTPS (DNS over HTTPS) or sometimes TLS. RFC 8484 defines the HTTPS form.

Both can run at once. Your browser may use its own resolver while your email program, chat app and system updater use the system one. That split is the heart of this topic: a VPN can steer the system resolver, but a browser that has its own configured provider may ignore that steering.

Does this mean the lookup leaves the tunnel? Usually not. With a full-tunnel VPN, all network traffic from the device, including the browser's encrypted lookups, goes through the tunnel to the VPN server first. The browser's chosen provider then sees the VPN server's address as the source rather than your home address. What changes is not whether the lookups are encrypted on your local network, but who answers them and which names can be answered.

Four combinations and what each means

Browser Secure DNS	VPN	Who can see your lookups	Typical effect
Off	Off	Your network and its DNS server	Lookups are readable on the local path
On	Off	The DNS provider you chose	Local path sees encrypted traffic to the resolver, but still sees where you connect
Off	On	The DNS server the VPN uses	Lookups travel inside the tunnel and are answered by the VPN's setting
On	On	The DNS provider you chose, seeing the VPN's address	Lookups are inside the tunnel, but internal names may fail and the resolver differs from the VPN's

The last row is the one that surprises people. Nothing is "broken" in a security sense, but your DNS is now handled by a provider you picked in the browser, not the one the VPN assigned. That has three practical consequences.

1. Which provider learns your browsing habits changes. A VPN's DNS and a public resolver are different organisations with different terms. Pick the one you are comfortable with and read its privacy statement.
2. Names that only exist inside a network may fail. A company's intranet, a printer at home or a router page lives in a private naming space that a public resolver cannot answer.
3. Location-aware answers may differ. Some sites return different addresses depending on where the resolver sits. Your browser might pick a server that is not the nearest one for the VPN's exit.

How to check which resolver your browser is really using

Do not assume. A short test shows you.

1. Disconnect the VPN and open a DNS check tool such as the DNS-related test on EFF's Cover Your Tracks site, or a standard DNS leak test page. Note the resolver names it reports.
2. Connect the VPN and refresh the same test. If the resolver is the same as before, your browser is using its own provider. If it changed to something different, the system resolver, steered by the VPN, is being used.
3. Toggle the browser setting. Turn Secure DNS off, reload the test, then back on. Three results side by side tell you exactly how your setup behaves.
4. Repeat on a second network such as a mobile hotspot. A setting that behaves differently on different networks usually points to how the network hands out DNS.

A resolver name that is not your VPN's is not automatically a leak. The harmful kind of leak is one that exposes your lookups to your local network or your internet provider when you expect them to be hidden. A browser-selected provider reached through the tunnel is a choice, not a leak, but you should know you have made it. For the harmful kind and how to recognise it, see what a DNS leak is.

Where to find the setting

Names vary between browsers and versions, but the path is similar in the major browsers.

• In Chromium-based browsers, open Settings, go to Privacy and security, then Security, and look for the option to use secure DNS. You can usually pick "use current service provider" or choose a named provider.
• In Firefox, open Settings, go to Privacy and Security, scroll to the DNS over HTTPS section and pick the protection level: off, default, increased, or max.
• In Safari and many mobile browsers, encrypted DNS is controlled at the operating system level rather than in the browser, so there may be no separate switch.

The important choice is between "use my system's DNS" (or "current service provider", which lets the system or VPN decide) and "use a specific provider". The first respects whatever the VPN sets. The second overrides it.

Which setting to choose

There is no single right answer, but the situations below point toward sensible defaults.

Your situation	Suggested browser setting	Why
Home use, VPN on only for public Wi-Fi	Secure DNS on with a provider you trust	Helps when the VPN is off
You connect to a workplace network or intranet	Use the system DNS	Keeps internal names working
You want one organisation to see your lookups	Use the system DNS while the VPN is on	The VPN decides the resolver
You want a specific filtering resolver (family, security)	Secure DNS with that named provider	The choice is explicit
Troubleshooting a site that will not open	Switch to system DNS temporarily	Removes one variable

If you are comfortable with the trade-off, the combination of Secure DNS plus a full VPN is fine. Just remember that you now rely on two parties, the VPN and the DNS provider.

Worked scenarios

The traveller on hotel Wi-Fi. Ploy lands in a new city and joins the hotel network. The hotel shows a sign-in page that only opens on a name the hotel network resolves itself. With Secure DNS on and the VPN not yet connected, the page does not open because the browser asks a public resolver, which does not know that name. She turns Secure DNS to "system" for a minute, signs in to the hotel page, connects the VPN and turns Secure DNS back on afterwards. For more on this order of steps, read how to use a VPN on hotel Wi-Fi.

The office worker and the intranet. Marcus connects to his employer's VPN and cannot reach the internal wiki by name. The same name works in another program. The cause is the browser's Secure DNS, which sends the name to a public resolver that has never heard of it. He changes the browser to use the system DNS and the wiki opens at once. Companies that rely on internal names usually document this exactly.

The family with a filtering resolver. A family uses a named resolver in the browser to filter unwanted sites for the children. When a parent turns on a personal VPN, the filter appears to stop working in other apps but keeps working in the browser, because the browser keeps its own provider. They realise the filter covers only the browser and decide how to handle the rest of the devices separately.

Troubleshooting checklist

If a site stops opening after you switch on the VPN, Secure DNS or both, work through these in order.

1. Does a raw numeric address open? If it does, the problem is name resolution.
2. Set the browser to use the system DNS and retry.
3. Disconnect and reconnect the VPN, then restart the browser, so it picks up the new network settings.
4. Clear the browser's DNS cache. Most browsers have an internal page for this, or a restart is enough.
5. Check whether the site works in another browser or in a private window. If it does, an extension or the browser's setting is responsible.
6. Try mobile data. A site that works there but not on Wi-Fi points to the local DNS handed out by the network.
7. Look at the VPN's own DNS options in its app, if it has any, and leave them at the defaults unless support advises otherwise. Our guide on split DNS explains why some names are deliberately sent elsewhere.

If your VPN connection works but pages will not open at all, VPN connected but no internet walks through a wider set of checks.

Limits to keep in mind

• Encrypted DNS is not complete privacy. The provider you choose can see your lookups. The destination address of each connection is still visible to whoever carries the traffic, unless a VPN hides it from the local network.
• A VPN does not stop the browser's own tracking. Cookies and fingerprinting continue whatever DNS you choose.
• Not every network allows encrypted DNS. Some workplaces and schools block it or force their own resolver, and the browser then falls back to the system setting.
• Settings change with updates. Browser updates may reset or rename the option, so recheck it after a major update.
• Do not guess which resolver you have. Test it with the VPN on and off.

Summary

A browser's Secure DNS setting and a VPN are two separate controls that both influence DNS. With a full-tunnel VPN, the browser's encrypted lookups still travel inside the tunnel, but the browser may bypass the VPN's own DNS server, which changes who answers your lookups and can break internal or local names. Test which resolver you are using with the VPN on and off, choose the system DNS when you need internal names to work, and use a named provider when you want that specific choice.

If you want to try these settings with a short prepaid pass, you can compare options on the pricing page at your own pace.