Secure DNS Connection Settings

Two settings cover almost every device. Copy the one your platform accepts, or pick your device below for the exact steps.

New to encrypted DNS? See how DoH, DoT and DoQ work before you pick one.

Android · Routers · Linux
DNS-over-TLS
dnsdoh.art
Windows · Browsers · Apple
DNS-over-HTTPS
https://dnsdoh.art/dns-query

No encrypted DNS option on the device? Set 194.180.189.33 as its DNS server. Filtering and ad blocking still work, but the queries themselves are not encrypted. Windows 11 is the exception: from that address alone it finds the encrypted endpoint by itself.

Want DNS-over-QUIC or DNS-over-HTTP/3? Both are live, and both need a client that speaks them - .

Browser Configuration

Encrypt your DNS queries within Chrome, Firefox, or Edge.
Note: This only affects the browser, not other apps on your device.

Chrome, Edge & Brave

DNS-over-HTTPS
Step 1

Go to Settings → Privacy and security → Security.

Step 2

Scroll to Use Secure DNS and select With Custom Provider.

Step 3

Enter the URL:
https://dnsdoh.art/dns-query

Mozilla Firefox

DNS-over-HTTPS
Step 1

Go to Settings → General → scroll to Network Settings → click Settings.

Step 2

Check Enable DNS over HTTPS. Select Custom.

Step 3

Enter the URL:
https://dnsdoh.art/dns-query

This is also where DNS-over-HTTP/3 comes from

Once that URL is in place, a Chromium browser connects to us over HTTP/3 with no further setting. We measured Chrome on Android arriving on UDP port 443 after nothing more than the three steps above. It is the only route to DoH3 that does not need extra software - and like any browser setting, it covers browsing only, not the rest of the device. More on the .

Safari / macOS Note

Safari uses the operating system's DNS settings. Use the to download the configuration profile.

How to Verify

After setup, visit Dns Leak Test. You should see servers from our encrypted upstreams - typically Cloudflare or Quad9, sometimes Google. If you see your ISP's DNS instead, the setup isn't active yet - the guide on how to fix a DNS leak walks through the common causes.

ChromeOS (Chromebook)

Chromebooks support Secure DNS system-wide - it covers every app, not just the browser:

  1. Open Settings → Security and Privacy
  2. Enable Use secure DNS and select With custom provider
  3. Enter https://dnsdoh.art/dns-query

DNS-over-QUIC and DNS-over-HTTP/3

Both run here and both work.
Neither is something an operating system will pick on its own - this page explains who can reach them.

All four transports are live

DNS-over-TLS · TCP 853
tls://dnsdoh.art
DNS-over-HTTPS · TCP 443
https://dnsdoh.art/dns-query
DNS-over-QUIC · UDP 853
quic://dnsdoh.art
DNS-over-HTTP/3 · UDP 443
https://dnsdoh.art/dns-query

DoH and DoH3 share one URL. Which of the two you get is decided by the client, not by the address you type.

How to actually reach DoH3

No operating system will do this for you. Windows 11 and Android both stop at DoH over HTTP/2 and DoT respectively, and no setting on our side changes that. The one route an ordinary user already has installed is a Chromium browser:

  1. Set Secure DNS to https://dnsdoh.art/dns-query - the has the exact steps.
  2. That is all. There is no HTTP/3 switch to find.

Our DoH endpoint answers with alt-svc: h3=":443"; ma=86400, and a browser already pointed at us takes the offer on its own. We measured Chrome on Android arriving on UDP port 443 after nothing more than the step above.

The upgrade is automatic; being found is not. A browser's Automatic Secure DNS mode only recognises resolvers on a list compiled into the browser, and we are not on it. You have to enter the URL once.

How to actually reach DoQ

DNS-over-QUIC is not implemented by any operating system or browser. It needs software written for it. Where that realistically exists:

  • ·Router firmware that lists DoQ among its upstream options. GL.iNet is the one widely sold consumer brand we found with it, on firmware 4.9 and later - .
  • ·dnsproxy or AdGuard Home run as a local forwarder, both open source.
  • ·Desktop DNS tools and command-line clients.
On Android there is no mainstream free client for DoQ. We looked, so that you do not have to. If encrypted DNS on the phone is the goal, gives you DoT system-wide and covers every app.

The h3:// scheme

If your client is dnsproxy or AdGuard Home, those two accept a scheme that forces HTTP/3 and refuses to fall back to earlier HTTP versions. It is their syntax, not a universal URL - other tools will reject it:

dnsproxy -u h3://dnsdoh.art/dns-query dnsproxy -u quic://dnsdoh.art
Testing with kdig? Read this first

Versions before Knot 3.4.7 - including the 3.3.4 that ships in Ubuntu 24.04 - abort the handshake against any certificate issued without a Subject field, reporting handshake failed (The requested data were not available.).

Ours is one such certificate. It is valid, and the same endpoint verifies cleanly with gnutls-cli and openssl s_client. Upgrade kdig, or test with another client:

q -s tls://dnsdoh.art example.com q -s quic://dnsdoh.art example.com

Router Configuration

Set it once and every device behind the router is covered, including the ones with no DNS settings of their own.
Not every router that offers encrypted DNS lets you name your own resolver - the ones below say which.

Keenetic

DoH / DoT
  1. Open router admin panel → Internet → DNS.
  2. Enable DNS over HTTPS or DNS over TLS.
  3. DoH URL: https://dnsdoh.art/dns-query
  4. DoT Hostname: dnsdoh.art
  5. Click Save. All connected devices are now protected.

Requires KeeneticOS 3.6+ for DoH, 3.4+ for DoT.

ASUS / Merlin

DoT Ready
  1. Go to WAN → Internet Connection.
  2. Scroll to DNS Privacy Protocol.
  3. Select DNS-over-TLS (Strict).
  4. Address: 194.180.189.33
  5. Hostname: dnsdoh.art

GL.iNet

DoT / DoH / DoQ
  1. Open NETWORK → DNS.
  2. Set the mode to Encrypted DNS, and DNS Provider to Manual.
  3. Pick the encryption type, then Add a Server and enter one of:
  4. tls://dnsdoh.art https://dnsdoh.art/dns-query quic://dnsdoh.art

The one widely sold consumer router that reaches all three. DoQ needs firmware 4.9 or later. GL.iNet's DNS documentation.

TP-Link Deco

DoH / DoT
  1. In the Deco app: More → Advanced → DoH&DoT.
  2. Turn the toggle on and choose DoH or DoT.
  3. Choose Enter DNS Server Address, not the preset list.
  4. DoH: https://dnsdoh.art/dns-query
    DoT: dnsdoh.art
  5. Tap Detect, then Save.

Default Mode falls back to unencrypted DNS if we are unreachable; Secure Mode does not, and drops the internet instead. TP-Link's own guide.

Synology SRM

DoH Ready
  1. Network Center → Local Network → General.
  2. Advanced Options → check Enable DoH.
  3. Click Custom.
  4. DoH URL: https://dnsdoh.art/dns-query

FRITZ!Box

DoT Ready
  1. Internet → Account Information → DNS.
  2. Check Use DNSv4 over TLS.
  3. Uncheck Fallback to unencrypted.
  4. Resolved Name: dnsdoh.art

TP-Link Archer

DoT / DoH
  1. Open Advanced → Network → Internet.
  2. DNS Privacy: choose DoT or DoH.
  3. DNS Mode: Ultra Secure Mode uses only the server you name; Default Mode falls back to unencrypted if it is unreachable.
  4. Type into the first DNS Server box:
    DoT: dnsdoh.art
    DoH: https://dnsdoh.art/dns-query
  5. Press Detect DNS Server, then save. The two extra boxes are optional and can stay empty.

Verified on an Archer AX72 Pro (AX5400), firmware 1.4.5. Once DoT or DoH is on, the router's Primary and Secondary DNS fields stop taking effect - TP-Link says so on the same page, and it catches people out. AC-series models offer DoH only.

MikroTik (v7+)

DoH CLI

Paste these commands into your MikroTik terminal:

/ip dns set use-doh-server="https://dnsdoh.art/dns-query" verify-doh-cert=yes /ip dns static add name=dnsdoh.art address=194.180.189.33

The static entry is needed so the router can resolve dnsdoh.art for the initial DoH connection.

OpenWrt

DoH via HTTPS-DNS-Proxy
opkg update && opkg install https-dns-proxy luci-app-https-dns-proxy # In LuCI: Services → HTTPS DNS Proxy → Add # URL: https://dnsdoh.art/dns-query

Plain IPv4, for routers with no encrypted option

Filtering and ad blocking work exactly the same. What you do not get is encryption: your ISP can still read the queries in transit. Every device behind the router is covered.

Xiaomi / Redmi
  1. Open 192.168.31.1 and sign in.
  2. Advanced Settings → Network → DNS.
  3. Choose Manual DNS and enter the address below.

Xiaomi router firmware has no encrypted DNS option at all, so this is the only route on the router itself. Encrypt on the devices instead if you need it.

Netgear, D-Link, Linksys

DNS settings sit under Internet or LAN setup. Netgear's consumer firmware has no field for an encrypted upstream, so plain DNS is the router-level option there too.

Primary DNS
194.180.189.33
Secondary DNS
Leave empty or 0.0.0.0

Also the fallback for any router whose encrypted DNS setting only accepts providers from a built-in list.

Smart TVs & Game Consoles

PlayStation, Xbox, Nintendo Switch, and most Smart TVs do not support encrypted DNS natively. The best option is to configure DoH/DoT on your router (above) - every device on your network is then covered automatically. Alternatively, set 194.180.189.33 as the Primary DNS in the device's own network settings: unencrypted, but you still get ad-blocking and filtering.

Android Configuration

Enable Private DNS to encrypt all DNS traffic on your device - both Wi-Fi and mobile data.

Step 1: Find the Setting

Stock Android / Pixel

Settings → Network & Internet → Private DNS

Samsung (OneUI)

Settings → Connections → More connection settings → Private DNS

Xiaomi (MIUI / HyperOS)

Settings → Connection & sharing → Private DNS

Oppo / Realme / OnePlus

Settings → Connection & sharing → Private DNS

Step 2: Enter Hostname

Select Private DNS provider hostname.

Enter the following hostname exactly:

dnsdoh.art

Tap Save. A small lock icon may appear in the status bar confirming Private DNS is active.

How to Verify

Open your browser and visit our DNS Leak Test. You should see servers from our encrypted upstreams - typically Cloudflare or Quad9, sometimes Google - not your ISP's DNS. Android uses DNS-over-TLS (port 853), which encrypts all traffic system-wide. On a VPN, check that the lookups still come from us - see does your VPN leak DNS.

What you get, and what you do not

Private DNS is DNS-over-TLS on port 853 - measured on the wire, and it covers every app on the phone, on Wi-Fi and on mobile data alike. That is a proper encrypted transport and it is what the mainstream gets.

Android does not offer DoH, DoQ or DoH3 system-wide, and no server can change that: the resolvers Android will discover on its own are compiled into the operating system. If you specifically want DNS-over-HTTP/3, the route is a browser you already have - see the . It covers browsing only, so most people are better served leaving Private DNS on.

Troubleshooting

"Couldn't connect" - Some networks (corporate, school, hotel Wi-Fi) block DNS-over-TLS on port 853. Switch to the Wi-Fi's DNS while on that network, or use a VPN.

Setting keeps resetting - Some Samsung devices reset Private DNS after reboot. Go to Settings → Battery → Battery Optimization and exclude the Settings app.

Android TV / Google TV

Private DNS also works on Android TV 9+ and Google TV devices (Chromecast, Nvidia Shield, Sony, TCL, Philips): go to Settings → Network & Internet → Private DNS (the exact path varies slightly by manufacturer), choose Private DNS provider hostname, and enter dnsdoh.art.

Configuration Profile (Recommended)

One-tap setup for iPhone, iPad, and Mac. Installs a system-wide encrypted DNS profile that works on both Wi-Fi and cellular data - something manual DNS settings in iOS cannot do.

Download Profile

.mobileconfig · DNS over HTTPS · ~2 KB

What the profile configures:

✓ DNS over HTTPS → https://dnsdoh.art/dns-query

✓ Works on all networks (Wi-Fi + Cellular + VPN)

✓ Ad & tracker blocking via server-side filters

✓ No app required - uses Apple's native DNS framework

Automatic discovery: iOS 16+ and macOS 13+ support DDR (RFC 9462). When a network assigns our resolver 194.180.189.33 as its plain DNS server, the system can discover the encrypted endpoint and verify it against a certificate that carries the resolver IP, with no configuration at all. The profile above is still the recommended setup because it follows you onto every network, including cellular. Details: how devices discover encrypted DNS.

Apple notes one limit worth knowing if you run your own resolver: DDR does not work when the DNS server's address is a private one such as 192.168.x.x, because private addresses cannot be put in a TLS certificate - nobody can prove they own them. That is why the resolver being discovered has to sit on a public address.

The install screen will say "Unverified", in red. That is expected. It means the profile carries no code-signing signature, not that anything is wrong with it or with the resolver. Signing a profile needs a certificate bought for that purpose, and we do not have one. What you can check instead is where the file came from: it is served over HTTPS from dnsdoh.art, the same domain it configures, and it is a 2 KB plain-text file you can open and read before installing. It sets one DNS server and nothing else.

iPhone & iPad

Step 1 - Download

Tap Download Profile above in Safari. You'll see a prompt: "This website is trying to download a configuration profile." Tap Allow.

Step 2 - Install

Open Settings → General → VPN & Device Management. Tap DNSDOH.ART DNS → Install. Enter your passcode when prompted.

Step 3 - Verify

Go to Settings → General → VPN & Device Management → DNS. You should see DNSDOH.ART as the active DNS provider.

macOS (Sequoia / Sonoma / Ventura)

Step 1 - Download

Click Download Profile above. The file dnsdoh.art.mobileconfig saves to your Downloads folder.

Step 2 - Install

Double-click the file. Open System Settings → Privacy & Security → Profiles. Select DNSDOH.ART DNS → click Install.

Step 3 - Verify

Open Terminal and run:
scutil --dns | head -20
You should see dnsdoh.art listed as the resolver.

How to remove the profile

iPhone/iPad: Settings → General → VPN & Device Management → DNSDOH.ART DNS → Remove Profile.

macOS: System Settings → Privacy & Security → Profiles → DNSDOH.ART DNS → remove (−).

Your device will instantly revert to your network's default DNS.

Alternative: DNSecure App

If you prefer an app to quickly toggle encrypted DNS on/off or manage multiple DNS providers, DNSecure is a free, open-source app for iOS and macOS.

1. Install

Download DNSecure from the App Store.

2. Add Server

Open the app → tap + → select DNS over HTTPS.
Enter URL: https://dnsdoh.art/dns-query

3. Activate

Toggle the server on. iOS will ask to allow a VPN configuration - tap Allow. All DNS traffic is now encrypted.

Troubleshooting

Q:

"This network is blocking encrypted DNS traffic"

Some corporate/hotel Wi-Fi networks block DoH. This is expected - the network administrator requires you to use their DNS. On cellular data, the profile will continue to work normally. You can also try switching to DNS over TLS (port 853), which some networks don't block.

Q:

Profile doesn't appear in Settings after download

Make sure you opened the download link in Safari, not Chrome or Firefox. Third-party browsers cannot install configuration profiles on iOS. If using macOS, double-click the .mobileconfig file to trigger the install prompt.

Q:

Does it work with iCloud Private Relay?

No - Private Relay overrides custom DNS profiles. If you use Private Relay, it handles DNS internally via Apple's servers. You must choose one: Private Relay or DNSDOH.ART. For ad blocking and custom filtering, disable Private Relay and use our profile instead.

Q:

Can I use this alongside a VPN?

It depends on the VPN. Most commercial VPNs (NordVPN, ExpressVPN, Mullvad) override DNS settings when active. When the VPN disconnects, the DNSDOH.ART profile takes over again automatically. WireGuard-based VPNs can be configured to use your DNS alongside.

Apple TV (tvOS)

tvOS has no on-screen setting for encrypted DNS. The practical route is to configure DoH on your router (see the Routers tab) so the Apple TV is covered automatically. Advanced users can install the same configuration profile via Apple Configurator from a Mac.

Windows 11

Native DoH

Windows 11 supports DNS-over-HTTPS natively - everything is done in Settings, no command line needed.

New: automatic setup (verified discovery)

Windows 11 can now find the encryption by itself. Enter only the DNS server address (steps 1-4 below): Windows sends the resolver one discovery query (DDR, RFC 9462), checks that the answer is backed by a certificate carrying our resolver IP, and fills the DoH template https://dnsdoh.art/dns-query in on its own.

Windows then resolves over DNS-over-HTTPS on TCP port 443 - measured on Windows 11 with fallback to unencrypted turned off. Windows has no system-wide DoH3 or DoQ, and advertising them cannot change that.

If that template appears automatically, verified discovery worked and steps 5-6 are already done for you. How it works: how devices discover encrypted DNS.

Configure DNS in Settings

1. Open Settings → Network & internet → Ethernet (or Wi-Fi → your network → Hardware properties).

2. Find DNS server assignment and click Edit.

3. Change from Automatic (DHCP) to Manual and turn on IPv4.

4. Preferred DNS: 194.180.189.33

5. Preferred DNS encryption: Encrypted only (DNS over HTTPS)

6. DNS over HTTPS template: select Manual Template and enter
https://dnsdoh.art/dns-query

7. Click Save.

No template field? (original Windows 11, 21H2)

On the first Windows 11 release the Settings UI only offered the built-in providers. Register our server once via PowerShell as Administrator, then repeat the steps above:

Add-DnsClientDohServerAddress -ServerAddress "194.180.189.33" -DohTemplate "https://dnsdoh.art/dns-query" -AllowFallbackToUdp $False -AutoUpgrade $True

How to Verify

Open PowerShell and run: Resolve-DnsName google.com | Select-Object Name,Type,IPAddress
Or visit DNS Leak Test - you should see servers from our encrypted upstreams - typically Cloudflare or Quad9, sometimes Google. If you see your ISP's DNS instead, the setup isn't active yet.

Windows 10

No Native DoH

Windows 10 has no built-in encrypted DNS - the Settings app only accepts plain DNS servers. You have two choices: plain DNS (simple, unencrypted) or a small helper app for full DoH encryption.

Option A: Plain DNS (No Encryption)

Ad blocking and filtering work, but your ISP can still see your queries.

  1. Control Panel → Network and Sharing Center.
  2. Change adapter settings → right-click your adapter → Properties.
  3. Select Internet Protocol Version 4 (TCP/IPv4) → Properties.
  4. Select Use the following DNS server addresses.
  5. Preferred DNS: 194.180.189.33 - leave Alternate empty.
  6. Click OK, then run ipconfig /flushdns in a command prompt.

Option B: Encrypted DoH (Free Software)

Two free ways to get the encryption Windows 10 itself lacks:

Browser DoH EASIEST

Chrome, Edge, and Firefox have built-in DoH - covers browsing only. See the .

dnscrypt-proxy SYSTEM-WIDE

Free, open-source local resolver. Install from GitHub and add https://dnsdoh.art/dns-query as a DoH server in dnscrypt-proxy.toml.

systemd-resolved (Ubuntu / Fedora / Arch)

The default DNS resolver on most modern Linux distributions. Supports DNS-over-TLS natively.

# Edit the resolved config sudo nano /etc/systemd/resolved.conf # Add these lines under [Resolve]: [Resolve] DNS=194.180.189.33 DNSOverTLS=yes
# Restart the service sudo systemctl restart systemd-resolved # Verify it's working resolvectl status | grep -A2 "DNS Server"

You should see 194.180.189.33 with +DNSOverTLS in the output.

NetworkManager (Desktop GUI)

For GNOME, KDE, and other desktop environments with a network manager GUI.

Step 1

Open Settings → Network → click the gear icon next to your connection.

Step 2

Go to the IPv4 tab. Set DNS to Manual. Enter: 194.180.189.33

Step 3

Click Apply. Toggle the connection off and on to activate.

Note: NetworkManager does not support DNS-over-TLS natively. For encrypted DNS, use the systemd-resolved method above or install stubby.

Stubby (Advanced - Any Distro)

A dedicated DNS-over-TLS resolver. Works on any Linux distribution, even older ones without systemd-resolved.

sudo apt install stubby # Debian/Ubuntu sudo dnf install stubby # Fedora
# Edit /etc/stubby/stubby.yml - add under upstream_recursive_servers: - address_data: 194.180.189.33 tls_auth_name: "dnsdoh.art"
sudo systemctl enable --now stubby # Then set your system DNS to 127.0.0.1 (stubby listens locally)

After setup

Verify it works

Run a DNS leak test - you should see our encrypted upstreams, not your ISP.
Troubleshooting

"Couldn't connect", port 853 blocked, or a broken site - answers in the knowledge base.
How it works

The protocols behind each option, with benchmarks and trade-offs.
What it doesn't cover

Encrypting DNS hides your lookups, not your IP address or browser fingerprint - see what a site still reads.