How to Configure Secure DNS and DoH Providers in Google Chrome

Domain Name System (DNS) queries are the foundational directory lookups of the internet, resolving human-readable domain names into numerical IP addresses. Historically, standard DNS queries were transmitted in plaintext over UDP port 53, leaving them exposed to interception, local ISP tracking, DNS spoofing, and rogue Wi-Fi redirection. Google Chrome includes native support for Secure DNS using DNS-over-HTTPS (DoH). DoH encapsulates DNS queries inside encrypted HTTPS sessions over port 443, preventing eavesdropping and tampering. Understanding how to configure Secure DNS in Chrome ensures robust browsing privacy and domain integrity.

Understanding DNS-over-HTTPS (DoH) in Google Chrome

Traditional DNS resolution transmits requests across your local network unencrypted. Anyone with access to network routing hardware—such as an ISP, workplace network administrator, or public Wi-Fi eavesdropper—can monitor every website you visit, even if the destination site itself uses HTTPS.

Secure DNS solves this privacy vulnerability by routing lookup requests through an encrypted TLS tunnel to a trusted recursive resolver. Google Chrome offers two operational modes:

• Automatic (Opportunistic DoH): Chrome checks whether your operating system’s configured DNS server supports encrypted DNS. If compatible, Chrome upgrades requests to DoH transparently while retaining your current DNS provider.
• Custom (Explicit DoH): Chrome bypasses local operating system resolvers and directs all browser DNS traffic to an explicit, authenticated DoH endpoint (such as Cloudflare, Google Public DNS, NextDNS, or Quad9).

Prerequisites and Browser Requirements

• Google Chrome version 83 or newer on Windows, macOS, or Linux.
• An active internet connection without restrictive corporate firewall rules blocking outbound HTTPS connections to custom resolver IP ranges.
• Standard user permissions (enterprise policy overrides apply on managed fleets).

How to Enable and Configure Secure DNS in Chrome

1. Launch Google Chrome on your workstation.
2. Click the three vertical dots (customise and control) in the upper-right corner and select Settings.
3. In the left sidebar, click Privacy and security.
4. Click on Security in the primary panel.
5. Scroll down to the Advanced section to locate the Use secure DNS setting.
6. Ensure the toggle switch is turned On.
7. Select your operational preference:
   • With your current service provider: Retains your network’s DNS server and uses encryption only if your provider supports DoH.
   • With: Opens a dropdown menu of pre-configured trusted resolvers, including Cloudflare (1.1.1.1), Google (Public DNS), OpenDNS, and CleanBrowsing (Family Filter).
8. To specify a custom DoH endpoint (e.g., a personalized NextDNS or AdGuard profile), select Custom and paste the resolver’s HTTPS URL (e.g., https://dns.quad9.net/dns-query).

Verifying Secure DNS Encryption

To confirm that Chrome is actively encrypting lookup requests rather than falling back to plaintext UDP:

1. Open a new tab in Chrome and navigate to your chosen resolver’s diagnostic portal (e.g., Cloudflare 1.1.1.1 Help or Quad9 verification).
2. Review the connection diagnostic table:
   • Using DNS over HTTPS (DoH): Must display Yes.
   • Using DNS over TLS (DoT): Typically No (Chrome uses HTTPS/443 rather than TLS/853).
   • DNSSEC Supported: Confirms whether DNS cryptographic validation is active.
3. Alternatively, navigate to chrome://net-internals/#dns to inspect Chrome’s internal DNS cache and resolver status.

Configuring Secure DNS via Enterprise Group Policy

For domain administrators managing Windows endpoints, Secure DNS can be enforced across workstations via Group Policy or Registry keys:

Path: HKLM\SOFTWARE\Policies\Google\Chrome
Value 1 Name: DnsOverHttpsMode
Value 1 Type: REG_SZ
Value 1 Data: "secure"  # Options: "off", "automatic", "secure"

Value 2 Name: DnsOverHttpsTemplates
Value 2 Type: REG_SZ
Value 2 Data: "https://chrome.cloudflare-dns.com/dns-query"

Troubleshooting Common Secure DNS Conflicts

• Captive Portal Blockades: Hotel or airport Wi-Fi networks requiring web authentication frequently block external DoH lookups until login is completed. Temporarily toggle Secure DNS to “Automatic” or complete portal login before enforcing custom resolvers.
• VPN and Corporate Split-Tunneling: Enterprise VPN clients often enforce internal corporate DNS to resolve private intranet resources. If internal intranet domains fail to resolve, configure Chrome to use the operating system provider.
• Parental Controls and SafeSearch: Choose specialized DoH providers (such as CleanBrowsing or Cloudflare 1.1.1.3) to automatically enforce malware protection and safe search filtering at the resolver layer.