Privacy education · November 2, 2026
Secure DNS Deserves a Settings Review
A practical review of browser Secure DNS settings, encrypted lookups, fallback behavior, current status, and the service answering your requests.
Reaching a website can begin with a name lookup. Secure DNS is worth reviewing because the selected setting, the service answering the request, and the conditions on your network can all matter.
A useful review begins with understanding the current arrangement. You do not need to choose a new provider simply because the option exists. First learn what your browser is doing and what a change would mean.
Understand the part being protected
Mozilla explains DNS over HTTPS as sending a domain-name lookup to a compatible DNS server over an encrypted HTTPS connection. The lookup helps find the address for a website. The encryption concerns that exchange with the resolver, the service answering the query.
Keep the review focused on that task. A secure lookup is not evidence that everything about a browsing session is private. Consider account sign-ins, site permissions, and the information you submit as separate choices. A DNS setting should not become a reason to share more than you intended.
Read the fallback behavior
In its current desktop guidance, Google describes Chrome's Secure DNS as enabled in automatic mode by default. If a lookup encounters problems in that mode, Chrome can make an unencrypted lookup instead. With a custom provider selected, Chrome does not automatically revert to unencrypted mode.
This difference makes the mode worth reading alongside the switch. A setting can express a preference while still allowing a different route when a request fails. Another configuration can result in an error that needs attention. Understand which behavior you selected before interpreting a successful page load as proof of how its name was resolved.
On desktop Chrome, the documented controls are in Settings, Privacy and security, Security, under Advanced. Inspect the selected service and mode rather than changing them from memory.
Check the status, not just the label
Firefox's protection-level guide describes a Default protection mode whose behavior depends on region and network conditions. It can use fallback resolvers and can turn DoH off when VPNs, parental controls, enterprise policies, or a network signal call for that behavior.
The same guide distinguishes Active, Not active, and Off. Its status display helps show whether Firefox is currently making secure DNS queries. These controls appear in Settings under Privacy & Security, in the DNS over HTTPS section; advanced options describe the available modes.
Read an unexpected status before trying to change it. It may reflect a connection problem or an intentional network arrangement. The useful question is what the status means on this device, rather than whether its wording sounds reassuring. Do not bypass an organization's controls to make a status indicator change.
Include the resolver in the decision
Encryption does not remove the need to consider who answers the request. Mozilla's overview notes that its default DoH partner can see users' queries. A resolver is therefore part of the privacy review, even when the connection to it is encrypted.
Before selecting a different service, read its current explanation of the information it receives, why it keeps records, and how long those records remain. Look for statements that apply to the DNS service you would actually use. A familiar name or an encrypted connection alone does not answer those questions.
Keep the choice proportionate. If you cannot explain why a replacement fits your needs, gather that information before changing a working arrangement.
Make a change you can understand
Record the current setting privately before making an intentional change. Then check the browser's status where available and try the services you normally need. A page loading successfully is a usability check, not a complete privacy test.
If something stops working, consult the browser's current troubleshooting guidance. On a managed device or a network with required filtering, ask the responsible administrator about the intended configuration. Chrome's guide specifically notes limitations for managed devices and parental controls.
Revisit the setting when your browser, device, or network arrangement changes. A short review of the mode, fallback, status, and resolver gives this privacy choice a clear purpose without turning one setting into a promise about your whole online life.