Private DNS Providers

Every time you visit a website, your device first needs to ask a DNS server to translate the site's name (like "example.com") into the IP address of the server hosting it. By default, this request travels in plaintext through your internet provider's DNS — meaning they can see exactly which sites you visit, even when you're using HTTPS.

Changing your DNS is one of the simplest and most immediately effective things you can do to improve your privacy. Private DNS services encrypt requests using protocols like DNS over HTTPS (DoH) or DNS over TLS (DoT), preventing your provider from reading those DNS queries. Many also block advertising and tracker domains at the DNS level, providing protection for all your devices without installing anything on them.

There's a catch though: encrypted DNS doesn't hide which sites you visit from your provider. When your browser opens an HTTPS connection, it sends the domain name in plaintext inside the SNI (Server Name Indication) field of the TLS handshake — before encryption kicks in. Your provider can still see your destination domain just by reading your network traffic, regardless of which DNS you use. The only technology that fixes this is ECH (Encrypted Client Hello), which also encrypts the SNI field — but it isn't widely supported yet. Anyone who wants to hide their browsing destination from their provider needs a VPN. What does your ISP actually see with encrypted DNS? →

For those who want full control, self-hosted solutions are available. A small local DNS server — even a Raspberry Pi works perfectly — can handle DNS requests for your entire home network, block advertising domains, and encrypt outbound communications. It's a project within reach even for those who aren't sysadmins, thanks to tools with intuitive graphical interfaces.

Here you'll find both ready-to-use DNS services you can configure in two minutes on your devices, and tools for those who want to build their own custom resolver.