Classic DNS is plain text. Anyone on the same network can see which sites are visited, and anyone in the path can change the answer. That is why operating systems and browsers started encrypting DNS:
- DNS over HTTPS (DoH): DNS queries travel inside HTTPS on port 443.
- DNS over TLS (DoT): DNS runs over a TLS-encrypted TCP connection on port 853. Android's "Private DNS" setting uses it.
- DNS over QUIC (DoQ): the same encryption over lower-latency QUIC, on UDP 853.
What is the problem for an organization?
If a device connects on its own to a DoH provider on the internet, the organization's DNS firewall drops out of the picture. Malicious domain blocking, category policy and logging are all bypassed. Many organizations therefore try to ban encrypted DNS entirely, but it is a losing battle; DoH looks like ordinary HTTPS traffic.
The better way: serve encrypted DNS yourself
NameDefence Defender runs DoH, DoT and DoQ listeners. Company devices still use encrypted DNS, but they connect to the organization's own resolver:
- Employees' queries are not visible in plain text on the network, even on guest Wi-Fi or in a café.
- All policy, threat blocking and logging keep working.
- Android devices can be given the company address as Private DNS, and Windows 11 and modern browsers can connect directly to Defender over DoH.
DoT and TCP connections are long-lived; a client can send thousands of queries over the same connection. This lowers latency and server load. A per-source-IP connection limit protects against abuse.
Devices outside the network
When a laptop is at home or in a hotel, reaching company DNS in plain text is unsafe and often impossible. The NameDefence endpoint agent uses the local Defender while the device is on the company network and an encrypted DoH connection when it is outside. Policy and records are the same in both cases.
Close outbound encrypted DNS
Once you offer your own encrypted DNS, it makes sense to block traffic to well-known public DoH providers by policy; employees now have an alternative. The blind spot closes without giving up privacy.
In short
Instead of fighting encrypted DNS, offer it on your own infrastructure. Privacy and control both stay with you.