The Vulnerability of Standard DNS
When you browse the internet using a modern web browser like Google Chrome, almost all of your traffic is encrypted via HTTPS. A padlock icon appears in your address bar, indicating that your Internet Service Provider (ISP), network administrators, or someone snooping on a public Wi-Fi network cannot see the passwords you type or the specific pages you view on a website.
However, there is a massive loophole in this privacy model: the Domain Name System (DNS).
Before your browser can establish a secure HTTPS connection to wikipedia.org, it must ask a DNS server to translate that name into an IP address. Historically, these DNS requests have been sent in “plaintext.” This means that while your ISP cannot see exactly what article you are reading on Wikipedia, they can see a clear, unencrypted log of every single website domain you visit.
To close this loophole, Google Chrome supports a protocol called DNS-over-HTTPS (DoH). This feature encrypts your DNS requests, hiding your browsing destinations from your ISP and local network administrators.
Step 1: Accessing Chrome’s Security Settings
DNS-over-HTTPS is a native feature in Google Chrome, but depending on your operating system and network configuration, it may not be enabled by default.
To enable and configure it:
- Open Google Chrome.
- Click the three-dot menu icon in the top-right corner and select Settings.
- In the left-hand sidebar, click on Privacy and security.
- In the main window, click on Security.
Step 2: Enabling Secure DNS
Scroll down until you find the section labeled Advanced.
Look for the toggle switch labeled Use secure DNS.
By default, this is likely toggled “On,” but it is probably set to the sub-option: With your current service provider.
This setting means Chrome will attempt to use DoH if your current ISP’s DNS server supports it. The reality is that many standard ISP routers do not support encrypted DNS, meaning Chrome will silently fall back to insecure, plaintext DNS requests without warning you.
Step 3: Forcing Encrypted DNS via a Third Party
To guarantee that your DNS requests are encrypted, you should not rely on your ISP. You must instruct Chrome to bypass your local router entirely and send all requests through a dedicated, secure third-party provider.
- Under the “Use secure DNS” section, select the radio button for With.
- Click the dropdown menu next to it.
- Select a trusted provider from the list. Cloudflare (1.1.1.1) and Google (Public DNS) are the most common, reliable, and fastest options.
Once you select a provider from this list, Chrome will immediately begin encrypting all future DNS queries and sending them directly to that provider.
Step 4: Using a Custom DNS Provider
If you use a specialized DNS provider—such as NextDNS or AdGuard DNS, which offer network-level ad blocking and malware filtering—you will not find them in the default dropdown menu.
You can use them by selecting Custom from the dropdown menu and pasting the specific HTTPS URL provided by your service.
For example, a custom URL looks like this: https://dns.nextdns.io/abcdef.
Do not enter standard IP addresses (like 8.8.8.8) into this box; the custom field requires a full HTTPS web address to establish the secure connection.
Step 5: Understanding the Limitations of DoH
While DNS-over-HTTPS is a massive upgrade for your digital privacy, it is critical to understand what it does not do.
- It is not a VPN: DoH encrypts your DNS requests, but it does not hide your IP address. The websites you visit still know exactly who you are and where you are located.
- Corporate Networks: If you are using a work computer on a corporate network, your IT department likely uses “managed browser policies.” They can force DoH to remain disabled so they can monitor network traffic and block malicious websites. If the “Use secure DNS” setting is greyed out and unclickable, your organization is managing the browser, and you cannot bypass it.
- Captive Portals: When you connect to a hotel or airport Wi-Fi, you often have to accept a terms of service page (a captive portal) before getting internet access. Because DoH bypasses the local network, captive portals will often fail to load if DoH is strictly enforced. If you cannot connect to public Wi-Fi, temporarily switch “Use secure DNS” back to “With your current service provider” until you authenticate.