By default, the DNS lookups your browser makes travel across the network in plain text — visible to your ISP and anyone on the same network. Google Chrome has a built-in Secure DNS feature that encrypts those lookups using DNS over HTTPS (DoH). Turning it on takes under a minute and works on Windows, macOS, Linux, and Chrome OS.
Step 1 — Open Chrome's Security Settings
Click the three-dot menu in the top-right corner and choose Settings, then go to Privacy and security → Security. Or jump straight there by pasting this into the address bar:
chrome://settings/securityScroll down to the Advanced section and find Use secure DNS.
Step 2 — Turn On "Use secure DNS"
Enable the Use secure DNS toggle. Chrome then gives you two choices:
- With your current service provider — Chrome upgrades to encrypted DNS automatically only if your existing resolver supports it. If it does not, Chrome silently falls back to plaintext.
- With (a specific provider) — you pick a named DoH resolver from a dropdown. This is the recommended option because it guarantees your queries are encrypted regardless of your network's default DNS.
Step 3 — Choose a DoH Provider
Select With and pick a resolver from the dropdown. Chrome lists several built-in options:
| Provider | Notable for |
|---|---|
| Cloudflare (1.1.1.1) | Speed, strict no-logging policy |
| Google (Public DNS) | Reliability, global reach |
| Quad9 | Blocks known-malicious domains |
| CleanBrowsing | Family-friendly content filtering |
| OpenDNS | Configurable filtering |
To use a provider that is not listed, choose Custom and paste its DoH endpoint (also called a URI template):
Cloudflare https://cloudflare-dns.com/dns-query
Google https://dns.google/dns-query
Quad9 https://dns.quad9.net/dns-query
AdGuard https://dns.adguard-dns.com/dns-queryCompare resolvers in our list of the best DNS providers or browse the full public resolver directory.
Step 4 — Verify DoH Is Working
Confirm the change took effect. If you selected Cloudflare, visit their connection diagnostics page — it reports whether DoH is active:
https://1.1.1.1/helpLook for "Using DNS over HTTPS (DoH): Yes". You can also confirm that name resolution still works normally with the ShowDNS DNS Lookup tool. If sites resolve as expected, encrypted DNS is live.
DnsOverHttpsMode policy and cannot be changed locally.Chrome on Android and iOS
Mobile Chrome does not expose its own Secure DNS setting — it uses the operating system's DNS instead. To encrypt DNS on mobile:
- Android — Settings → Network & internet → Private DNS → set a provider hostname (this uses DNS over TLS at the OS level, covering every app including Chrome).
- iOS — install a DNS configuration profile from your provider (for example, Cloudflare's 1.1.1.1 app), which enables encrypted DNS system-wide.
A Note on Privacy
Enabling DoH stops your ISP and local network from seeing your DNS queries — but the provider you choose can still see them. Pick a resolver with a clear, audited no-logging policy, and remember that DoH does not hide the destination IP addresses you connect to. For the full picture of what DoH does and does not protect, see What Is DNS over HTTPS (DoH)?