# DNS over HTTPS **URL:** https://discuss.privacyguides.net/t/dns-over-https/24704 **Category:** Questions **Created:** 2025-02-05T23:16:51Z **Posts:** 39 ## Post 1 by @win11.shading291 — 2025-02-05T23:16:51Z Does it matter if I’m pretty much always on a VPN connection? If yes, what is the default protection? I mean, what does it mean that Firefox decides _when_ to use secure DNS? Also, why would I not want always “Max Protection”? --- ## Post 2 by @anon36940904 — 2025-02-05T23:27:03Z What exactly are you trying to understand from your end about DNS and VPNs and browsers? You’re asking three different questions and only hinting at what you want to understand but you’re not cohesive about it. We need more exposition. --- ## Post 3 by @win11.shading291 — 2025-02-05T23:40:55Z Sorry, let me rephrase. I’ve already got an answer in the past that changing DNS provider on my router isn’t really necessary if I’m always on a VPN connection anyways. But other people in my house won’t, so the question is still relevant to me. When I disconnect to the VPN and check [1.1.1.1 — One of the Internet’s Fastest, Privacy-First DNS Resolver](https://one.one.one.one/help/) , it will say I’m connected to 1.1.1.1 but never using DoH. When I put “max protection”, it will say I’m connected using DoH. So my question would be, what’s the benefit of not putting “Max Protection”? ![image](//forum-uploads.privacyguidesusercontent.com/original/2X/1/16a7ccc7d9b444df15fdfa22fa54d0b4cfc3552a.png) --- ## Post 4 by @anon36940904 — 2025-02-05T23:50:22Z Well, read the three options and details of what they do and why you may want to select either of them. If you always want to ensure your DNS is secure, then Max Protection should always be selected. But if you find other options to be a better fit for ones browsing needs, then select one of the other options. In my view, if VPN is not always on or not always used, then always use Max Protection. --- ## Post 5 by @win11.shading291 — 2025-02-05T23:59:48Z I read them all and I’m still confused. What are the benefits of not using Max Protection. It talks about “If secure DNS is not available, sites will not load or function properly.” Does that really happen? If so, how/why? --- ## Post 6 by @anon36940904 — 2025-02-06T00:03:41Z > [@win11.shading291](#): > > Does that really happen? If so, how/why? It is very unlikely but not impossible. It can happen if the website is brand new and some things may not be configured well or if the DNS provider records have not been updated. Or if it is a sketchy website with no security of any kind on the website. 99.9% of the time, it should not happen. --- ## Post 7 by @win11.shading291 — 2025-02-06T00:05:16Z Thanks! --- ## Post 8 by @anon36940904 — 2025-02-06T00:05:17Z And to me, there are no benefots of not using it for the safety I want with my browsing. But I always use a VPN so this is not even a thing I think about. --- ## Post 9 by @ruihildt — 2025-02-06T10:20:26Z The “Default protection” is probably there because Firefox relies on third-party DoH resolvers (like Cloudflare and NextDNS) and they don’t ever want to have the browser blamed for a third party service not working. AS an end user and if you want to have DoH enabled, you should definitely use `Max protection`. --- ## Post 10 by @ignoramous — 2025-02-06T11:21:38Z > [@win11.shading291](#): > > Does that really happen? If so, how/why? A couple I can think of: 1. Some DNS queries are only resolvable by network / system resolvers (ex: `.lan`, `.internal`, `.local` etc). 2. Your network may block access to DoH, in which case the client may decide to use network / system DNS. If you want your browser to _never_ rely on network / system resolver even if it means inaccessible websites, you’d have no trouble using _Max Protection_. > [@ruihildt](#): > > they don’t ever want to have the browser blamed for a third party service not working That isn’t the case. --- ## Post 11 by @ruihildt — 2025-02-06T11:38:38Z > [@ignoramous](#): > > That isn’t the case. What do you mean? I’m not private to Firefox decision making, so this is why I said “probably”, but there could well be other reasons. --- ## Post 12 by @win11.shading291 — 2025-09-27T23:47:20Z To answer my own question “Also, why would I not want always “Max Protection”?“, the answer would be “to prevent DNS leak”.” More on the below topic: > [@Recommend against custom DNS in browsers while using a VPN](https://discuss.privacyguides.net/t/recommend-against-custom-dns-in-browsers-while-using-a-vpn/29209): > > Hello there. I am writing this to suggest that PrivacyGuides not recommend using the Secure DNS / DNS Over HTTPS feature on the browser recommendation and configuration page. The reason for this is because this feature causes DNS Leaks when using a VPN. (Note that the DNS Server’s ISPs aren’t saying ProtonVPN, Datacamp, Cogent, or literally anything else except for the DNS Provider selected on the other tab) There is also the fact that all three VPNs recommende… Edit: I’m a bit confused as I just checked Mullvad default’s and MaxProtection is enabled. As you are not supposed to change Mullvad’s setting, it must mean I am not understanding something. Could anyone explain? Is there really a DNS leak risk if you use a VPN with max protection? --- ## Post 13 by @win11.shading291 — 2025-10-14T20:41:08Z @ruihildt @ignoramous The thread above confused me. From Proton’s [site](https://protonvpn.com/support/dns-leaks-privacy/), it seems right. > **We therefore strongly recommend against using DoH (and the similar DNS over TLS standard) with Proton VPN**. Meaning, I should probably remove my router config and just use the VPN at all times and install the VPN on other people’s computer in my home. But on Mullvad Browser, it is setup as max protection by default. I don’t want to touch the setting, because of fingerprinting. So, I’m confused on what I should do. ![image](https://forum-uploads.privacyguidesusercontent.com/original/2X/6/66010b6fc8678d8e15f92d39f80d6efc9b9628eb.png) --- ## Post 14 by @ruihildt — 2025-10-27T22:41:58Z The DNS is not technically part of the browser fingerprint. It is there by defaultin Mullvad Browser, because we can’t assume where and how users are going to use Mullvad Browser. If you use a trustworthy VPN (which potentially could be looking at all your traffic), then you should trust them not to look at your DNS queries either. --- ## Post 15 by @Alca — 2025-10-27T22:51:35Z If you are almost always connected to a VPN, then why would you want to enable DNS over HTTPS? I don’t understand. Your VPN is supposed to provide you with private DNS. In my case, I have that option disabled. But be careful, DNS over HTTPS is not a “security measure.” You are only protecting your queries. --- ## Post 16 by @win11.shading291 — 2025-10-27T23:24:23Z Meaning, I should put it as ‘default protection’ instead of ‘Max Protection’ if I use a VPN all the time, correct? Leaving Max Protection would risk DNS leak, right? Thanks a lot for your answers :slight_smile: --- ## Post 17 by @anonfox — 2025-10-28T14:33:12Z > [@ruihildt](#): > > The DNS is not technically part of the browser fingerprint. But it can be detected by websites and potentially used for fingerprinting --- ## Post 18 by @anon57862721 — 2025-10-28T14:55:02Z Because DNS is not a core part of the browser as an app (in that it is network related and more a part of the internet the app connects through/with), I don’t think it is part of browser fingerprint as they say. Can you also explain why you think so? I want to know where you’re coming from. --- ## Post 19 by @anonfox — 2025-10-28T14:57:23Z > [@anon57862721](#): > > Can you also explain why you think so? Because it’s another parameter that can be detected by websites to form unique fingerprints for their users. Being network related doesn’t mean much, IP addresses are also network related. --- ## Post 20 by @anon57862721 — 2025-10-28T14:59:04Z Actually this is a good question. Even I don’t know or have a conclusive answer. Perhaps someone can respond clarifying it. --- ## Post 21 by @any1 — 2025-10-28T15:09:58Z Because there is no data on how many people use Mullvad Browser with Proton VPN, and how many of those have which DNS settings selected, you just have to make the decision you think is best for you. I would stick to one provider and turn the browser’s DNS off when using a VPN. If being fingerprinted this way is a problem, your only other option would be using the Tor Browser. --- ## Post 22 by @win11.shading291 — 2025-10-28T16:11:58Z [@team](/groups/team) Following this topic, I believe a note should be put on that regards that if you use Mullvad Browser with a VPN with settings to max protection, there could be a DNS leak. Maybe even change the recommendation for everyone to change the DNS settings to default Protection. --- ## Post 23 by @anon57862721 — 2025-10-28T16:13:31Z I don’t think DNS would leak. The browser will still use its DNS or your VPNs. How is that a DNS leak? --- ## Post 24 by @win11.shading291 — 2025-10-28T16:14:32Z I’m not the expert here, but please see this topic: > [@Recommend against custom DNS in browsers while using a VPN](https://discuss.privacyguides.net/t/recommend-against-custom-dns-in-browsers-while-using-a-vpn/29209): > > Hello there. I am writing this to suggest that PrivacyGuides not recommend using the Secure DNS / DNS Over HTTPS feature on the browser recommendation and configuration page. The reason for this is because this feature causes DNS Leaks when using a VPN. (Note that the DNS Server’s ISPs aren’t saying ProtonVPN, Datacamp, Cogent, or literally anything else except for the DNS Provider selected on the other tab) There is also the fact that all three VPNs recommende… --- ## Post 25 by @anon57862721 — 2025-10-28T16:16:44Z I guess we’re thinking of “leak” here differently but overall agree that your VPNs DNS should be the only one used. --- ## Post 26 by @Alca — 2025-10-29T21:54:08Z Now I understand your question a little better. I think what you’re looking for is an additional layer of protection, even though the connection is still routed through a VPN (with its private DNS). So yes, you can leave it enabled because the connection is routed through your private VPN. There’s no problem, but I recommend another type of more robust protection layer, such as TOR. --- ## Post 27 by @win11.shading291 — 2025-10-30T02:09:39Z From my understanding, this would potentially create a leak and you should not do that. See this topic: > [@Recommend against custom DNS in browsers while using a VPN](https://discuss.privacyguides.net/t/recommend-against-custom-dns-in-browsers-while-using-a-vpn/29209): > > Hello there. I am writing this to suggest that PrivacyGuides not recommend using the Secure DNS / DNS Over HTTPS feature on the browser recommendation and configuration page. The reason for this is because this feature causes DNS Leaks when using a VPN. (Note that the DNS Server’s ISPs aren’t saying ProtonVPN, Datacamp, Cogent, or literally anything else except for the DNS Provider selected on the other tab) There is also the fact that all three VPNs recommende… I already put mine to default protection. --- ## Post 28 by @Alca — 2025-10-30T22:27:46Z In theory, no, because it’s behind a VPN. Correct me if I’m wrong. You also have to consider that you have to trust your VPN provider, and nowadays I would only trust Mullvad or AirVPN. --- ## Post 29 by @win11.shading291 — 2025-11-03T00:41:09Z I’m convinced now you have to either put it to off or default protection. [From the topic I linked:](https://discuss.privacyguides.net/t/recommend-against-custom-dns-in-browsers-while-using-a-vpn/29209) > I am writing this to suggest that PrivacyGuides not recommend using the Secure DNS / DNS Over HTTPS feature on the browser recommendation and configuration page. The reason for this is because this feature causes DNS Leaks when using a VPN. > There is also the fact that all three VPNs recommended by Privacy Guides [[Mullvad](https://mullvad.net/en/help/dns-leaks), [ProtonVPN](https://protonvpn.com/support/dns-leaks-privacy/), and [IVPN (page hosted by IVPN)](https://www.dnsleaktest.com/how-to-fix-a-dns-leak.html)] all specifically recommend to not use this feature. Mullvad: > #### Firefox on desktop > > To turn off DNS over HTTPS follow these steps: > > 1. Click on the menu button and select **Settings**. > 2. Click on **Privacy & Security** in the left column. > 3. Scroll down to the bottom. Under **Enable secure DNS,** click on **Off**. > > #### Portmaster > > Portmaster hijacks DNS queries. Try to uninstall that. > > ### Browser extensions > > If you have installed a browser extension that can change the DNS, for example [CIRA Canadian Shield](https://www.cira.ca/en/canadian-shield/), then turn that off. Proton: > **We therefore strongly recommend against using DoH (and the similar DNS over TLS standard) with Proton VPN**. When using our apps, all DNS queries are sent through the VPN connection to our servers, and are thus securely encrypted without the need for DoH or DoT. IVPN: > Mozilla Firefox > > ``` > Select the menu button and go to Settings. > In the Privacy & Security menu, scroll down to the Enable secure DNS using: section. > Choose Off. > ``` My only remaining interrogation is about router settings, which doesn’t seem to be covered in the three links of Mullvad/Proton/iVPN. Could anyone answer this? If I want to configure DNS like NextDNS or 1.1.1.1 on my router, am I suceptible to DNS leak as well? I’m always using a VPN, but some people in my household don’t want to (working on that :sweat_smile:). So I at least changed my DNS on my router, but would that give me a DNS leak risk? --- ## Post 30 by @ignoramous — 2025-11-07T18:41:05Z > [@anon57862721](#): > > this is a good question. Even I don’t know or have a conclusive answer. Perhaps someone can respond clarifying it. DNS resolution requests can be used to fingerprint users. One such demo: [http://dnscookie.com/](http://dnscookie.com/) > [@ruihildt](#): > > The DNS is not technically part of the browser fingerprint. If browsers handle DNS, then DNS technically IS part of the browser fingerprint… though, just not during / after the webpage rendering / JS execution phase. > [@win11.shading291](#): > > Could anyone answer this? (logged in again to respond since you tagged me long back) If Firefox / Mullvad’s browser use the VPN to send requests to the DoH endpoint (which I think is what they’ll do), I don’t think you have to worry too much about the perceived “exposure” even if there’s a “DNS leak” (DNS resolved by an external endpoint and not VPN’s own DNS). --- ## Post 31 by @win11.shading291 — 2025-11-10T16:40:14Z > [@ignoramous](#): > > (logged in again to respond since you tagged me long back) Thanks! :slight_smile: > If Firefox / Mullvad’s browser use the VPN to send requests to the DoH endpoint (which I think is what they’ll do), I don’t think you have to worry too much about the perceived “exposure” even if there’s a “DNS leak” (DNS resolved by an external endpoint and not VPN’s own DNS). ELI5? :sweat_smile: :rofl: --- ## Post 32 by @ignoramous — 2025-11-12T14:47:18Z > [@win11.shading291](#): > > ELI5? :sweat_smile: :rofl: Not quite ELI5, but: As far as using in-browser DNS with VPN is concerned, it is okay to do so as our concern of “standing out from the crowd” (by not using VPN’s DNS) is side-stepped by the fact that browser will relay DNS over the VPN, just like it does with HTTP. And so, the IP won’t leak. Btw, the above is also true for _Private DNS_ as implemented in AOSP 10+, which routes all DNS requests over a VPN, if set up. But, I guess your concern is similar to ([from the GrapheneOS FAQ](https://grapheneos.org/faq#custom-dns)): > Apps and web sites can detect the configured DNS servers by generating random subdomains resolved by querying their authoritative DNS server. This can be used as part of fingerprinting users. If you’re using a VPN, you should consider using the standard DNS service provided by the VPN service to avoid standing out from other users. This specific fingerprinting (which I don’t think is widely deployed) will work (in that, it’ll expose to remote that you are one of those who use `XYZ DNS` _with_ `ABC VPN`), but if the browser is sending a DNS request, it is most likely the webpage we’ve visited is requesting it (in which case, the webpage already has way more fingerprints than what this DNS fingerprint might expose to the remote server). --- ## Post 34 by @win11.shading291 — 2025-11-20T15:56:12Z Yet another example why I don’t agree with this site’s policy on AI. Pinging @jonah Because of it, I had to chat on pm with ignoramous answering questions that many seem to have. The conclusion to this post is that DNS on a browser should be disabled when you’re using a VPN at all times (with kill-switch on for instance). --- ## Post 35 by @Banter8905 — 2025-11-24T18:51:34Z Having read this entire thread I am still somewhat puzzled. Can someone please clarify,If one is using a VPN do you still need to use DNS over HTTPS? If one is using a VPN is it pointless to have 1.1.1.1 set at the router level? --- ## Post 36 by @anon57862721 — 2025-11-24T18:57:16Z Your VPN comes with a DNS resolver of its won so it is normally recommended to always default to it. You don’t need additional or a custom DNS setting in your browser for example. You will still have DNS over HTTPS via your VPN. > [@Banter8905](#): > > If one is using a VPN is it pointless to have 1.1.1.1 set at the router level? Yeah, don’t do this (unless you really want to keep using Cloudflare for some reason). --- ## Post 37 by @Banter8905 — 2025-11-24T19:13:31Z > [@anon57862721](#): > > Yeah, don’t do this (unless you really want to keep using Cloudflare for some reason). Thanks for clarifying everything above. BTW if one uses Cloudflare as per the description above at the router level, does that result in a DNS leak? --- ## Post 38 by @anon57862721 — 2025-11-24T19:17:01Z > [@Banter8905](#): > > does that result in a DNS leak? If you know you’re using Cloudflare, and check for DNS leaks at [dnsleaktest.com](http://dnsleaktest.com), it should not show another DNS as your resolver (other than Cloudflare). If this is the case, no DNS leak. If not, there is DNS leak. But I have never used DNS settings of my router as I like to have that on the device level but you can test it out and see for yourself. Experimenting with low risk things like this also teaches you a lot (I only say that assuming you’re new to this stuff given your valid questions). And if you are using at the router level, make sure your browser is not using a custom DNS either, otherwise it will use your browser’s DNS preference you set and will disregard Cloudflare from your router (which is what my understanding is of how this works). --- ## Post 39 by @win11.shading291 — 2025-11-25T18:06:00Z > [@Banter8905](#): > > Having read this entire thread I am still somewhat puzzled. Thank you for confirming my point :stuck_out_tongue: “Yet another example why I don’t agree with this site’s policy on AI.” > [@Banter8905](#): > > Having read this entire thread I am still somewhat puzzled. Can someone please clarify,If one is using a VPN do you still need to use DNS over HTTPS? No. VPN has its own DNS. If you want to be absolutely sure, enable VPN kill switch. All traffic will go through your VPN’s DNS. Disable your browser’s DNS (or put to default and it will use your VPN’s DNS. > [@Banter8905](#): > > If one is using a VPN is it pointless to have 1.1.1.1 set at the router level? Yes. Unless there are other people on your household who don’t use VPN for instance. > [@Banter8905](#): > > does that result in a DNS leak? That’s where Lumo’s answer is the best and I couldn’t rewrite it better myself. Complain to the team to have the reply unhidden.