Before your phone can open a website or an app can reach its server, it has to ask a simple question: "What is the IP address for this name?" That question goes to the Domain Name System, or DNS. It happens many times a minute, mostly invisibly, and it says a lot about what you do online.

This guide explains what DNS reveals, how it is used for blocking, what encrypted DNS (DoH and DoT) changes, how it works together with a VPN, and what a "DNS leak" is and how to check for one.

What DNS is and what it reveals

Think of DNS as the internet's phone book. You type a name such as example.com; a DNS resolver, usually run by your internet provider or mobile operator, looks up the number (the IP address) and sends it back. Your device then connects to that address.

Traditional DNS was designed decades ago and sends these questions unencrypted. That means anyone on the path, including the Wi-Fi network operator and your internet provider, can see:

  • Which domain names you look up, and when.
  • Which apps are active, because many apps contact their own servers in the background.
  • Patterns over time, such as when you wake up or which services you use daily.

HTTPS encrypts the content of a page, but not this lookup. So even with a padlock in your browser, plain DNS can expose the names of the sites you visit.

How DNS-level blocking works

Because every connection usually starts with a DNS lookup, DNS is a simple place to restrict access. A resolver can answer with a wrong address, an error, or nothing at all, and the app simply fails to connect.

A recent example: Reuters reported on 12 February 2026 that some domain names associated with WhatsApp disappeared from Russia's national register of domain names, and that devices in Russia stopped receiving the app's IP addresses. Without an address, the app could not reach its servers.

DNS is only one of several layers used for restrictions. Networks can also filter by IP address or inspect traffic, so changing DNS settings alone often changes little. This article explains how the technology works; check your local laws before changing how you connect.

Encrypted DNS: DoH and DoT

Two standards encrypt the DNS question and answer between your device and the resolver.

DNS over TLS (DoT)

RFC 7858, published by the IETF in May 2016, defines DNS over TLS. It wraps DNS in the same TLS encryption used by HTTPS, on a dedicated port, 853. Because it uses its own port, a network can tell that you are using encrypted DNS, even though it can't read the lookups.

DNS over HTTPS (DoH)

RFC 8484, published in October 2018, specifies sending DNS queries and answers over HTTPS, with each query and answer handled as one ordinary HTTP exchange. To the network, DoH looks much like normal web traffic.

What encryption changes, and what it doesn't

  • It hides your lookups from the Wi-Fi network and others on the path.
  • The resolver still sees them. You are moving trust from your provider's resolver to the one you choose, so choose a provider whose privacy policy you are comfortable with.
  • The connection after the lookup is still visible. Your device still connects to the site's IP address, and that can reveal a lot.

Encrypted DNS on your devices

Android. Google announced DNS over TLS support, called Private DNS, for Android P (Android 9) on 17 April 2018. You can find it in your network settings, usually under Private DNS, where you can leave it on automatic, turn it off, or enter the hostname of a provider. Menu names vary between phone makers.

Chrome. According to Google Chrome Help, Chrome's "Use secure DNS" setting is on in automatic mode by default. If Chrome has trouble looking up a site in this mode, it falls back to the ordinary, unprotected lookup. If you select a custom provider, Chrome won't fall back. The feature isn't available on managed devices or when parental controls are on.

The important point: browser settings protect only that browser, while system settings like Private DNS cover more of the device.

How DNS works with a VPN, and what a DNS leak is

When a VPN is connected, your device should send DNS lookups through the encrypted tunnel to a resolver chosen by the VPN, not to your local network's resolver. Your provider then sees only that you are connected to a VPN server.

A DNS leak happens when some lookups escape the tunnel and go to your provider's resolver anyway. The VPN still carries your traffic, but the list of sites you visit is exposed. Common causes:

  • A device or app configured to use a specific DNS server that ignores the VPN.
  • Brief moments when the tunnel reconnects, such as switching from Wi-Fi to mobile data, if nothing blocks traffic in between. A kill switch addresses this; see what a VPN kill switch does.
  • Split tunnelling, where some apps deliberately use the normal connection.

Private DNS on Android and a VPN can both be on. Which resolver actually answers depends on your system and the VPN app, so the reliable answer is to test.

VPNRice uses DNS in one more way: its ad and tracker blocking, where available on your plan, is a DNS filter that blocks known ad, tracker and malware domains for apps on the device.

How to check for leaks

  1. Connect your VPN and open a DNS leak test page in your browser. It shows the resolvers that answered your lookups.
  2. Look up the resolver addresses with our IP lookup tool. If they belong to your home internet provider or mobile operator while the VPN is on, lookups are leaking.
  3. Check the rest of your browser with our WebRTC leak test, which looks at a different leak: addresses exposed through WebRTC. Our guide on checking your IP and WebRTC leaks explains the results.
  4. Repeat after switching networks, for example from Wi-Fi to mobile data.

If you see a leak, check for custom DNS settings in your browser or apps, update the VPN app, and test again.

Key takeaways

  • DNS lookups reveal which sites and services you use; plain DNS is unencrypted.
  • DNS is a common place for blocking, but rarely the only one.
  • DoT (RFC 7858) and DoH (RFC 8484) hide lookups from the network, but the resolver still sees them.
  • With a VPN, lookups should go through the tunnel; test after connecting and after switching networks.
  • For how VPN protocols protect the rest of your traffic, see our guide to WireGuard and modern VPN protocols.