Check what encrypted DNS protects

Describe the protection accurately

DNS over HTTPS encrypts DNS queries between a client and the chosen resolver. That can reduce observation or modification on that segment of the path. It does not turn an untrusted website into a safe one, hide every destination from the network or prevent the resolver from handling your queries.

Browser DNS, operating-system DNS and a VPN's DNS configuration can differ. Start by identifying which application you are testing rather than assuming one setting controls every device and app.

Review one client at a time

1. Open the browser's genuine privacy or security settings and locate its secure-DNS option. Record the present setting before changing it. Managed browsers may have an enforced policy.
2. Identify the resolver selected and read its public documentation. Distinguish encryption from optional threat blocking; they are separate features and may use different endpoints.
3. On a personally managed device, enable a supported encrypted-DNS option if it fits your needs. On an organisation's device, follow the network owner's policy because internal names and monitoring may depend on the established resolver.
4. Test public website access and any required internal services. Also test after reconnecting your existing VPN, if one is used. A change that silently breaks internal names is not a successful configuration.

Verify the scope

Use the resolver's documented diagnostic method when available, and inspect browser policy or status information. A successful web page load alone does not demonstrate that encrypted DNS was used. Some configurations fall back when the preferred resolver is unavailable; read the setting's actual behaviour.

Keep the result narrow: this browser used a particular DNS path in this test. Do not claim that every application on the computer is protected unless you tested the relevant system configuration too.

Understand the remaining trust

HTTPS connections, browser updates and careful sign-in checks remain necessary. A threat-filtering resolver can miss a new malicious domain, and a legitimate domain can host a compromised page. Encrypted DNS also does not prevent account misuse on a genuine service.

Reverse a problematic change safely

If essential names stop resolving, restore the recorded setting and document which service failed. Investigate policy and resolver compatibility before trying another endpoint. Choose based on documented behaviour and the network's purpose, not on a claim that one toggle provides complete privacy.