Se protéger

Turning on encrypted DNS is free, takes a minute, and is genuinely worth doing. It is also, routinely, sold as something it is not. If you have seen a setting called *Private DNS* or *Secure DNS* and wondered whether it replaces a VPN, the short answer is no — and the reason is more interesting than the answer.

What encrypted DNS actually encrypts. Before your device can load a site, it asks a resolver to translate the name into an address: *what is the IP of example.com?* Historically that question travelled in plain text, so anyone on the path could read it. DNS over HTTPS (DoH) and DNS over TLS (DoT) wrap that question in encryption. The lookup is protected. Nothing else is.

What it does not hide, and this is the part that matters. Once the lookup is done, your device opens a connection to the address it received. That connection reveals the destination in two ways your ISP can still read: the IP address you connect to, and the server name in the TLS handshake — the field known as SNI, which historically travels unencrypted even on HTTPS sites. So your provider can still assemble a list of the sites you visit, without ever seeing a single DNS query.

There is a fix for the second half — Encrypted Client Hello conceals that server name — but it depends on both the site and your browser supporting it, so you cannot assume it is in play.

What a VPN does differently. A VPN encrypts the whole connection between your device and its server, so the local network and your ISP see one encrypted tunnel to one address instead of a list of destinations. That closes the gap encrypted DNS leaves open. It also moves the question rather than answering it: whoever runs the VPN is now positioned where your ISP was.

The sentence that settles most of the confusion: encrypted DNS decides *who learns what you are looking up*; a VPN decides *who can see where you go*. They operate at different layers, and neither substitutes for the other.

The part almost nobody mentions. Switching to encrypted DNS does not remove the observer — it changes which one. Your resolver still sees every domain you request, in order, tied to your address. Turning on DoH with a large public resolver moves that visibility from your internet provider to that resolver's operator. That may well be an improvement, depending on which of the two you would rather trust and which is subject to which jurisdiction. But it is a choice of observer, not an absence of one, and the marketing language of *private DNS* obscures exactly that.

So, practically. Turn encrypted DNS on: it is free, it stops passive reading of your lookups on the local network, and it blocks the crude DNS-level redirection some networks perform. Choose the resolver deliberately rather than accepting the default, because you are choosing who keeps that list. And do not let it stand in for a VPN if what you actually want is that the network you are on cannot tell where you went.