DNS and VPN guide · sources checked 2026-11-03
DNS over HTTPS and VPNs: separate protections, different trust points
Compare DNS over HTTPS with a VPN by the traffic each protects, which resolver can see a lookup, and how browser DNS settings can interact with a VPN.
Short answer: are DNS over HTTPS (DoH) and a VPN the same thing?
No. DoH encrypts DNS queries between a configured client and a DoH resolver. A VPN creates a connection to a VPN endpoint and can carry covered device or app traffic through it. They address different parts of the path: DoH changes how a DNS lookup travels to its resolver; a VPN changes the network path for traffic routed through its tunnel. Neither term by itself tells you which resolver is in use or what that resolver retains.
What can the Wi-Fi network or ISP see?
Without a VPN, an unencrypted DNS lookup can be visible to network operators along its path. DoH encrypts the DNS exchange to the selected resolver, so an on-path observer cannot read the query from that exchange; the observer can still see that your device connects to a network service, and DoH does not conceal the IP address of the website connection. With a working VPN carrying the traffic, the local network and ISP generally see a connection to the VPN endpoint and traffic patterns rather than the carried destinations. Exact visibility depends on routing, exclusions, and whether the VPN is working.
Can the DoH resolver still see my DNS queries?
Yes. Standard DoH protects the exchange in transit to the configured resolver, but that resolver has to process the requested domain to answer it. The IETF protocol also notes that the resolver connection can carry information that may correlate requests. Choosing DoH changes which intermediary can read the query; it does not make the resolver blind or establish its logging practices.
If I use DoH with a VPN, do they duplicate each other?
Not necessarily. If a browser sends DoH through the VPN tunnel, the local network and ISP see the VPN connection while the DoH resolver receives the DNS query. The VPN endpoint can see a connection from the tunnel to the DoH service, but the DoH HTTPS exchange remains encrypted to that service. If DoH is excluded from the tunnel or another app uses a different DNS route, the path can differ. VPN and DNS app behavior varies; confirm the route and resolver in the documentation for your particular client.
Can browser DoH override the VPN’s DNS choice?
It can change which resolver the browser asks, but behavior is client-specific. Mozilla documents that Firefox Default Protection can disable DoH when a VPN is active, while other Firefox protection modes can keep a selected DoH provider active. That is a Firefox behavior, not a rule for every browser, operating system, or VPN. Check the browser’s current secure-DNS status, VPN DNS documentation, and split-tunnel rules before drawing a conclusion.
Which setup should I choose?
Start with the observer and the traffic you want to protect. If your concern is an untrusted local network reading ordinary DNS lookups, DoH can encrypt those lookups to its resolver. If you also want covered app traffic routed through a VPN, the VPN addresses a broader network path and shifts trust to the VPN provider. Review the resolver’s and VPN provider’s privacy terms separately; neither encryption method establishes a no-logs claim, hides activity from the destination site after connection, or makes you anonymous.
How can I check what is happening without changing settings?
Record the browser and VPN app, whether the VPN says connected, its DNS documentation, the browser secure-DNS status, and any app exclusions. Use the same browser-based DNS test once with the VPN off and once with it on, on the same network, and compare the observed resolver with the documented expectation. A test observes its own lookups at that time; it does not audit every app or establish whether a provider retained data. See the DNS leak test guide for a cautious checklist. On a managed work or school device, ask its administrator before changing DNS or VPN settings.