What Private DNS changes on the wire
Traditional DNS from a phone or laptop to a recursive resolver uses cleartext UDP or TCP (port 53). Any switch, captive portal, or observer on the same broadcast domain can read QNAMEs and infer destinations even when HTTPS encrypts the web payload. Private DNS is an umbrella term for carrying those same DNS messages inside TLS: DNS over TLS (DoT) on a dedicated port (RFC 7858) or DNS over HTTPS (DoH) as an HTTPS application (RFC 8484).
Neither protocol hides that you are using DNS—only the query contents from parties that are not the TLS endpoint. Your resolver operator can still log queries unless they publish minimization practices; a VPN moves that visibility to the tunnel egress instead.
DoT vs DoH in practice
DoT is easy to identify on port 853 and straightforward for OS-level “Private DNS” modes (Android) or systemd-resolved stubs. DoH reuses HTTP/2 stacks, rides on port 443, and is common inside browsers—helpful when port 53 is intercepted but 443 is open, yet it can complicate split-horizon policies because it resembles other HTTPS traffic.
Enterprise and home considerations
- Split DNS: Internal names may still require on-VPN or on-net resolvers; blind DoH to a public resolver can break RFC 1918 management URIs unless you deploy forwarding rules.
- Visibility for SOC teams: Mandatory DoH without local inspection endpoints removes a historical telemetry source; replace it with resolver logging you control or endpoint DNS agents.
- Guest networks: On untrusted Wi‑Fi, encrypted DNS reduces trivial spoofing of responses, but it does not authenticate the hotspot itself.
Resolver policy: ECS, minimization, and oblivious modes
EDNS Client Subnet (ECS, RFC 7871) lets recursive resolvers forward part of your subnet to authoritative nameservers so CDNs return a geo-close edge address. That improves performance but reintroduces coarse client network data into the delegation path—enterprise resolvers often strip ECS for privacy.
QNAME minimization (RFC 7816) reduces disclosure at each delegation hop by not sending the full query name to parent zones. Recursive vendors advertise support; it matters most for operator-run resolvers you control.
Oblivious DoH (ODoH) adds a proxy so the resolver does not see the client IP and the proxy does not see plaintext DNS—another trust-splitting pattern analogous to proxied HTTP. Operational complexity is higher; most clients still use straight DoH/DoT to a chosen resolver.
For resolver selection trade-offs (speed, filtering, ECS behavior), read public DNS benefits. After enabling Private DNS, confirm which resolver answers your queries using your connection diagnostics workflow—many platforms expose the active resolver in settings or developer tools.