DNS Over HTTPS vs VPN: Which Protects Your Privacy Better?

DNS lookups are only one part of a connection

Before an app connects to a service, DNS usually translates a domain name into an IP address. Traditional DNS may expose that lookup to the local network or ISP. DNS over HTTPS sends the lookup to a compatible resolver over an encrypted HTTPS connection.

The website connection that follows is separate. DoH does not change your public IP and does not automatically protect traffic from every app. Mozilla's official DoH explanation also notes trade-offs involving filtering, parental controls, enterprise networks, and resolver trust.

What DNS over HTTPS does

DoH is a focused privacy control. It is especially useful when a browser would otherwise send readable DNS queries over an untrusted network.

DoH strengths

• Encrypts domain-name lookups to a compatible resolver.
• Reduces ordinary DNS visibility for the local network and ISP.
• Can be enabled in supporting browsers without routing all device traffic.
• May work with Encrypted Client Hello to reduce additional hostname exposure in supporting setups.

DoH limits

The resolver can still receive queries, destination IP addresses may remain visible on the network path, and browser-level DoH may not cover other apps. It can also bypass local filtering or fail on managed and captive-portal networks.

What a VPN does

A VPN creates an encrypted tunnel from the device to a VPN server for traffic the operating system routes through it. Sites then see the VPN server's public IP rather than the original network IP.

VPN strengths

• Protects more than browser DNS when traffic is routed through the tunnel.
• Reduces local-network visibility into destinations and traffic metadata.
• Changes the public IP address seen by websites and services.
• Provides one repeatable protection layer across unfamiliar networks.

VPN limits

A VPN provider becomes part of the trust path. A VPN does not stop cookies, account tracking, fingerprinting, phishing, or malware, and some apps or system features may bypass or interrupt a tunnel.

DoH, VPN, or both?

Choose based on the actual privacy goal

The right control depends on what is exposed and which software owns the connection.

You only want to encrypt Firefox DNS queries

DoH may be enough for that narrow goal. Confirm the protection level and resolver in Firefox settings, and remember that other apps are outside a browser-only configuration.

You are using airport Wi-Fi

Complete the portal, then connect the VPN before opening sensitive apps. DoH alone does not tunnel the rest of the device's traffic.

A work or school service stops resolving

The network may depend on private DNS or filtering. Return DoH to its default mode or follow the organization's policy instead of forcing a custom resolver.

A DNS test shows an unexpected resolver

Reconnect the VPN, close and reopen the browser, check custom DNS settings, and retest. An unexpected resolver is a configuration clue, not proof that all traffic is exposed.

Configure without creating a DNS conflict

1. Set a baseline. Run a DNS test before changing settings and note the resolver shown.
2. Connect the VPN. Confirm the tunnel is active before opening the browser or app you want to test.
3. Check DoH behavior. Use the browser's default protection first; avoid forcing a custom resolver unless you need it.
4. Retest. Confirm the expected public IP and DNS resolver, then check again after changing networks.

If a setting breaks captive portals, parental controls, or internal services, return to the default and change one layer at a time.

Related privacy guides

Encrypted DNS vs VPN Privacy

Understand resolver privacy, IP exposure, and how the two layers can interact.

How to Test and Fix a DNS Leak

Check which resolver is active and troubleshoot unexpected DNS paths.