← Guides

Private DNS Setup Guide: Stop Your ISP From Logging Every Domain You Visit

Every time you open a site, your device makes a DNS lookup to turn a domain into an IP address. By default that request goes out in plain text, often to your ISP's resolver. Your ISP can log the domain, the time, and the pattern. Encrypted DNS fixes that with little cost. DNS-over-HTTPS is defined in IETF RFC 8484 and wraps DNS inside HTTPS so your ISP cannot read the lookup.

Choosing a DNS Provider

Mullvad DNS is the default answer here: Swedish jurisdiction, outside investors kept at a distance, and a public audit trail. Quad9 is close behind. It is a Swiss non-profit and moved its headquarters to Zürich for better legal protection. NextDNS has the nicest control panel, but it is still a US company. For sensitive traffic, that matters.

Setup: Android (Simplest)

Android 9+ already has Private DNS built in. No extra app needed.

Setup: iOS (Requires Configuration Profile)

iOS has no simple built-in Private DNS switch. You need a configuration profile or an app.

Setup: Windows

Windows 11 supports DoH natively. Windows 10 needs a workaround.

Setup: macOS

macOS needs either a profile or a third-party app. There is no plain GUI toggle for DoH.

Setup: Router (Protects Every Device at Home)

Router-level encrypted DNS covers every device on your home network, including smart TVs, IoT junk, and anything else that ignores local settings.

The VPN + DNS Interaction

When the VPN is on, DNS usually goes through the VPN provider's resolver and overrides your normal system setting. Here is what that means in practice:

• Mullvad VPN: Uses Mullvad DNS automatically. You can still turn on extra blocking in the app.
• IVPN: Uses IVPN's own no-log resolver when connected.
• Split tunnel apps: Traffic outside the VPN still uses your OS-level DNS settings. That gap matters.
• Kill switchA VPN feature that blocks internet traffic if the VPN connection drops, preventing accidental exposure of your real IP address.Glossary →: If the VPN drops and you have no kill switch, DNS can fall back to your ISP. System-level DoH gives you a backup.

Verifying Your Configuration

# Test 1: DNS leak test (web)
# Visit: dnsleaktest.com → Extended Test
# Should show ONLY your chosen provider (Mullvad, Quad9)
# If your ISP appears: your DoH config is not working

# Test 2: Check what DNS server you're using (Linux/macOS terminal)
resolvectl status         # Linux (systemd-resolved)
scutil --dns | grep nameserver  # macOS

# Test 3: Confirm DoH is actually encrypted (not just different DNS)
# The easiest check: does your ISP still appear in dnsleaktest.com?
# If yes: still leaking. If only your provider appears: working.

Advanced: Self-Hosted DNS with Unbound

If you do not want any third-party resolver, run Unbound on a VPS outside Five Eyes countries. It acts as a recursive resolver and talks to authoritative DNS servers directly.

# On a VPS (Debian/Ubuntu):
sudo apt install unbound

# /etc/unbound/unbound.conf basic privacy-hardened config:
server:
    interface: 127.0.0.1
    port: 53
    do-ip4: yes
    do-udp: yes
    do-tcp: yes
    hide-identity: yes    # Don't reveal server identity
    hide-version: yes     # Don't reveal version
    qname-minimisation: yes  # QNAME minimisation (privacy)
    val-log-level: 0
    use-caps-for-id: yes  # DNS 0x20 encoding (spoofing resistance)

# Point your devices at the VPS IP with dnscrypt-proxy
# forwarding to the VPS over DoH

In this setup, your ISP sees encrypted traffic to your VPS, not direct DNS lookups. The VPS still sends standard DNS queries onward, but you control the box doing it.

Cunicula receives no funding from DNS providers. Mullvad DNS, Quad9, and NextDNS are all independently operated services. Our recommendation is based on jurisdiction, audit history, and business model.