DNS over HTTPS vs a VPN: What Each One Hides
Encrypted DNS — usually DNS over HTTPS or DNS over TLS — hides your name lookups from everyone on the network path, so your internet provider and the local Wi-Fi operator can no longer read which hostnames you asked about. A VPN hides all of your traffic from those same parties, including the lookups if it is configured properly.
They are not competitors so much as different scopes. Understanding what each leaves exposed is more useful than picking a winner.
What encrypted DNS covers
It wraps your queries so only your chosen resolver can read them. Traditional lookups travel in the clear, which means the local network, your provider, and intermediate networks can all see the names — the exposure described in how DNS resolution works.
Encrypting that channel removes one specific disclosure: the hostname list is no longer readable by anyone between you and the resolver. It also makes tampering harder, since a party in the middle cannot quietly substitute a different answer.
What it does not touch:
- Your IP address. Sites still see your real address, and so does everything you connect to.
- Your traffic destinations. Once the name is resolved, your device connects to that address in the open. Your provider sees which addresses you contacted, and address blocks often identify the service plainly.
- The name in the connection handshake. Encrypted connections typically announce the hostname so the server can present the right certificate, and that announcement has historically been readable. So the name can leak on the connection even when the lookup was encrypted — the subject of what still names the sites you visit.
- Visibility to the resolver. Whoever you chose still receives the complete list. Encryption protects the path, not the destination.
What a VPN covers
It encrypts everything leaving your device and moves the address the internet sees. Your provider sees an encrypted stream to a VPN server and nothing about what is inside it — not addresses, not hostnames, not handshakes. Sites see the VPN server’s address instead of yours.
If the client sets the tunnel’s resolver correctly, DNS is covered too, so a VPN subsumes what encrypted DNS provides for the parties on your local path.
What it does not touch:
- Visibility to the VPN provider. You have moved the trust, not removed it. The provider is now in the position your internet provider was in.
- Accounts, cookies, and fingerprints. These identify you regardless of address, which is the boundary set out in what a VPN hides about your IP address.
- Leaks. A VPN’s coverage is only as complete as its configuration, and both DNS leaks and IPv6 leaks are ordinary failure modes rather than exotic ones.
Where they overlap and where they do not
Against a party watching your local network — public Wi-Fi, a shared connection, your own provider — a VPN covers strictly more than encrypted DNS. There is no scenario in which encrypted DNS hides something from that party that a working VPN does not.
Against the party you resolve through, neither helps. Encrypted DNS means your chosen public resolver sees your queries. A VPN means your VPN provider’s resolver does. In both cases you have selected who receives the list.
Against the sites you visit, only a VPN does anything, and only to the address.
Against a resolver-based block or filter, encrypted DNS may route around a filter implemented at the provider’s resolver, and so may a VPN. Neither helps against blocks implemented on the traffic path rather than in DNS — which is why filtering that stops working when you change resolvers was resolver-based, and filtering that does not was not.
Why they are worth running together
Because your VPN is not always connected, and the browser layer behaves independently.
If the tunnel drops or you use the connection without it, encrypted DNS still protects your lookups from the local network. That is a genuine gap-filler, especially on networks you do not control.
There is a friction to know about, though: a browser with its own encrypted DNS enabled will bypass the resolver your VPN client configured. Depending on your priorities that is either a useful independent safeguard or an unwanted override of a deliberate setting. If your goal is that all lookups follow the tunnel, the browser’s setting is the one to check first when a leak test surprises you.
The usual sensible arrangement is: encrypted DNS configured at the system or router level as a baseline, and the VPN client allowed to take over resolution while connected.
Choosing when you only want one
Pick based on the threat you actually have.
Encrypted DNS is enough if your concern is a local network reading your lookups, or a resolver-level filter, and you are not trying to hide your address from the sites you visit. It is free, built into modern browsers and operating systems, and costs essentially nothing in speed.
A VPN is what you need if you want your address substituted, your traffic destinations hidden from your provider, or protection on a network you have no reason to trust. It costs money, adds a hop, and requires you to trust the provider — and it is the only one of the two that changes what sites see.
The framing that keeps this straight
Encrypted DNS changes how one question is asked. A VPN changes where all your traffic appears to come from.
Neither makes you anonymous, and both work by choosing a party to trust rather than by removing the need for one. When someone claims either tool hides your browsing, the useful follow-up is always: hidden from whom. The answer is different for each tool, and it is never “everyone”.