{"id":20711,"date":"2023-02-17T22:17:11","date_gmt":"2023-02-17T18:17:11","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/secure-dns-private-dns-benefits\/20711\/"},"modified":"2023-02-17T22:17:28","modified_gmt":"2023-02-17T18:17:28","slug":"secure-dns-private-dns-benefits","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/secure-dns-private-dns-benefits\/20711\/","title":{"rendered":"Why you should set up secure DNS \u2013 and how"},"content":{"rendered":"<p>Setting up an internet connection on a computer or smartphone is normally automated and you don\u2019t need to delve into doing it manually. But there is one detail worth noting, and that is the choice of DNS and its mode. If you spend a little time on this, you can protect yourself from cyberattacks, ISP spying, unwanted content for children, and even ads. What, for example, is Private DNS in Android settings, and how do you use it?\n<\/p>\n<h2>DNS and its disadvantages<\/h2>\n<p>\nDNS stands for Domain Name Service. It translates human readable web addresses (domain names, for example kaspersky.ru) into digital IP addresses used by computers on the net (185.85.15.34). Almost every internet query starts with a computer contacting a DNS server to translate a site name entered into its IP address. And almost always it\u2019s be done by the DNS server of your internet provider, while the request to it is neither encrypted nor signed. This insecurity brings many side effects.\n<\/p>\n<ul>\n<li>Your provider always knows which sites you visit and can use this to show you targeted ads.<\/li>\n<li>It\u2019s easy for the provider to spoof the IP address in its response, showing a completely different site to the one you wanted to see. You\u2019ve probably encountered this when connecting to free Wi-Fi in a hotel, cafe, or airport, where the first thing that pops up instead of the site you want is a page requesting authorization or showing ads.<\/li>\n<li>The same technology <a href=\"https:\/\/www.kaspersky.com\/about\/press-releases\/2014_kaspersky-lab-sheds-light-on--darkhotels--where-business-executives-fall-prey-to-an-elite-spying-crew\" target=\"_blank\" rel=\"noopener nofollow\">can be used by attackers<\/a> to control the Wi-Fi network that you\u2019re connected to. They can insert fake sites that spread malware or steal bank card information.<\/li>\n<\/ul>\n<p>\nHowever, address substitution in DNS responses can have positive practical uses, for example, for parental control services \u2013 loading a stub page if there\u2019s an attempt to visit \u201cundesirable\u201d sites. However, this technology isn\u2019t very precise, and blocks sites in their entirety \u2013 for example, the whole of youtube.com rather than specific \u201cbad\u201d pages. Therefore, it\u2019s not used in <a href=\"https:\/\/me-en.kaspersky.com\/safe-kids?icid=me-en_kdailyplacehold_acq_ona_smm__onl_b2c_kasperskydaily_wpplaceholder____ksk___\" target=\"_blank\" rel=\"noopener\">Kaspersky Safe Kids<\/a>.<\/p>\n<p>But you don\u2019t have to use your ISP\u2019s DNS server. There are public DNS servers with good reputations, such as those from Cloudflare (1.1.1.1) or Google (8.8.8.8), which you can specify in your internet settings and get rid of some of the problems described above.<\/p>\n<p>There are also DNS servers with additional functions \u2013 such as blocking access to ad servers. They remove ads in both the browser and other applications. To do this, simply specify the address of the <a href=\"https:\/\/blahdns.com\/\" target=\"_blank\" rel=\"nofollow noopener\">appropriate \u201cfiltering\u201d DNS server<\/a> in the Wi-Fi settings of your computer or smartphone.<\/p>\n<p>Unfortunately, simply changing the DNS address to 1.1.1.1 or 8.8.8.8 doesn\u2019t solve privacy issues. An ISP or an intruder controlling the network can snoop on DNS queries, interfere with them, or block access to a third-party DNS.\n<\/p>\n<h2>Private DNS and Secure DNS<\/h2>\n<p>\nLarge corporations and enthusiasts may run their own DNS server and apply any query rules they want to it. In a strict sense, <strong>Private DNS<\/strong> is not a high-privacy server \u2013 just a private, non-public server. In practice, Private DNS is often run on secure DNS protocols. The Private DNS setting in Android 9 and higher, for example, should be called Secure DNS to convey its essence more accurately.<\/p>\n<p><strong>Secure DNS<\/strong> is several competing protocols that differ from ordinary DNS by having encryption. These are <strong>DNS over HTTPS<\/strong> (<strong>DoH<\/strong>), <strong>DNS over TLS<\/strong> (<strong>DoT<\/strong>), and <strong>DNSCrypt<\/strong>. They differ in communication protocols and ports through which DNS requests are passed. There are still debates about which is better and which is worse. However, sometimes ISPs block access to a third-party DNS, in which case the DoH protocol has the best chance since it\u2019s more difficult to filter. But it\u2019s not necessary to go into the finer points of Secure DNS. The main thing is that your smartphone, computer or browser supports at least one of these protocols, and has a DNS server that can be used with it.<\/p>\n<p>There\u2019s no shortage of free secure servers \u2013 major ISPs (Cloudflare, Google, etc.) support public DNS (1.1.1.1, 8.8.8.8), which you can connect to via both unsecured DNS and DoH\/DoT. So your job comes down to enabling this secure access.\n<\/p>\n<h2>Already got a VPN?<\/h2>\n<p>\nSecure DNS and VPN are complementary technologies. Even if you\u2019ve enabled a VPN, site name requests may go through an unencrypted DNS channel, and then all of the above risks remain. Some commercial VPN services include their encrypted DNS in the default connection profile, or offer to enable their VPN and third-party secure DNS simultaneously through an app. But this isn\u2019t common practice so it\u2019s worth rereading the information from your VPN provider, or asking technical support. If secure DNS is not offered, it can be enabled in addition to the VPN (see the instructions below).\n<\/p>\n<h2>Enable secure DNS<\/h2>\n<p>\nHere\u2019s the easiest way to enable secure DNS on Android (9 and above): go to <em>Settings<\/em>, select <em>More connections<\/em> or <em>Advanced<\/em>, and find the <em>Private DNS<\/em> subsection there. Specify the server desired, and the configuration is complete. A slightly mysterious nuance is that Android doesn\u2019t accept numeric addresses in this section, so you\u2019ll need to check the domain name of the desired DNS server with the provider (for example, <strong>1dot1dot1dot1.cloudflare-dns.com<\/strong>).<\/p>\n<div id=\"attachment_47210\" style=\"width: 386px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/usa.kaspersky.com\/blog\/files\/2023\/02\/secure-dns-private-dns-benefits-01.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-47210\" class=\"wp-image-47210\" src=\"https:\/\/usa.kaspersky.com\/blog\/files\/2023\/02\/secure-dns-private-dns-benefits-01.png\" alt=\"Setting up Secure DNS on Android\" width=\"376\" height=\"546\"><\/a><p id=\"caption-attachment-47210\" class=\"wp-caption-text\">Setting up Secure DNS on Android<\/p><\/div>\n<p>Apple devices have had DoH\/DoT support since iOS 14 and macOS 11. However, there\u2019s no built-in setting to enable these protocols, so you need one of the many third-party tools from the App Store that can activate your preferred secure server. You can find them by searching for \u201cSecure DNS\u201d. Experienced users can <a href=\"https:\/\/github.com\/paulmillr\/encrypted-dns\" target=\"_blank\" rel=\"nofollow noopener\">install required configuration profiles<\/a> manually or create them themselves.<\/p>\n<p>Windows 10 has had DoH support since version 19628 (from 2020), and you can enable it through these <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows-server\/networking\/dns\/doh-client-support\" target=\"_blank\" rel=\"nofollow noopener\">instructions<\/a> on the Microsoft website.<\/p>\n<div id=\"attachment_47216\" style=\"width: 400px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/usa.kaspersky.com\/blog\/files\/2023\/02\/secure-dns-private-dns-benefits-02-EN.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-47216\" class=\"size-full wp-image-47216\" src=\"https:\/\/usa.kaspersky.com\/blog\/files\/2023\/02\/secure-dns-private-dns-benefits-02-EN.png\" alt=\"Setting up Secure DNS in Windows 10\" width=\"390\" height=\"673\"><\/a><p id=\"caption-attachment-47216\" class=\"wp-caption-text\">Setting up Secure DNS in Windows 10<\/p><\/div>\n<p>Chrome and Firefox browsers can make DNS queries over an encrypted channel, irrespective of OS-level support.<\/p>\n<div id=\"attachment_47217\" style=\"width: 1445px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/usa.kaspersky.com\/blog\/files\/2023\/02\/secure-dns-private-dns-benefits-03-EN.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-47217\" class=\"size-full wp-image-47217\" src=\"https:\/\/usa.kaspersky.com\/blog\/files\/2023\/02\/secure-dns-private-dns-benefits-03-EN.png\" alt=\"Setting up Secure DNS in Google Chrome\" width=\"1435\" height=\"746\"><\/a><p id=\"caption-attachment-47217\" class=\"wp-caption-text\">Setting up Secure DNS in Google Chrome<\/p><\/div>\n<p>In some countries, this option is enabled by default, but it\u2019s better to check it in the browser settings.<\/p>\n<div id=\"attachment_47218\" style=\"width: 1436px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/usa.kaspersky.com\/blog\/files\/2023\/02\/secure-dns-private-dns-benefits-04-EN.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-47218\" class=\"size-full wp-image-47218\" src=\"https:\/\/usa.kaspersky.com\/blog\/files\/2023\/02\/secure-dns-private-dns-benefits-04-EN.png\" alt=\"Setting up Secure DNS in Firefox\" width=\"1426\" height=\"956\"><\/a><p id=\"caption-attachment-47218\" class=\"wp-caption-text\">Setting up Secure DNS in Firefox<\/p><\/div>\n<p>An important nuance for <a href=\"https:\/\/me-en.kaspersky.com\/premium?icid=me-en_bb2022-kdplacehd_acq_ona_smm__onl_b2c_kdaily_lnk_sm-team___kprem___\" target=\"_blank\" rel=\"noopener\">Kaspersky users<\/a>: to ensure that your protection is properly configured, first activate protected DNS on the router, in the OS, or in browser settings. Then check that you have the right Kaspersky setting enabled: <em>The gear icon in the bottom of the left pane \u2192<\/em> <em>Security settings \u2192 Network Setting \u2192 Traffic Processing<\/em>.<\/p>\n<div id=\"attachment_27883\" style=\"width: 1017px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2023\/02\/17221632\/secure-dns-private-dns-benefits-05-KPremium.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-27883\" class=\"size-full wp-image-27883\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2023\/02\/17221632\/secure-dns-private-dns-benefits-05-KPremium.png\" alt=\"Checking Kaspersky settings for working with Secure DNS\" width=\"1007\" height=\"672\"><\/a><p id=\"caption-attachment-27883\" class=\"wp-caption-text\">Checking Kaspersky settings for working with Secure DNS<\/p><\/div>\n<p>Here, you can also specify the specific DoH servers that you plan to use.<\/p>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"premium-generic\">\n","protected":false},"excerpt":{"rendered":"<p>Have you ever come across the words Secure DNS or Private DNS in your smartphone settings and security apps? It\u2019s best to keep this feature enabled \u2013 it has many advantages.<\/p>\n","protected":false},"author":2722,"featured_media":20713,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1225,9],"tags":[2088,1172,105,16,1265,21,1012,1061,1328,43,321,131,113],"class_list":{"0":"post-20711","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-privacy","8":"category-tips","9":"tag-tips","10":"tag-advertising","11":"tag-android","12":"tag-chrome","13":"tag-dns","14":"tag-firefox","15":"tag-internet","16":"tag-ios","17":"tag-macos","18":"tag-privacy","19":"tag-technology","20":"tag-tips-2","21":"tag-windows"},"hreflang":[{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/secure-dns-private-dns-benefits\/20711\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/secure-dns-private-dns-benefits\/25219\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/secure-dns-private-dns-benefits\/10687\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/secure-dns-private-dns-benefits\/27879\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/secure-dns-private-dns-benefits\/25549\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/secure-dns-private-dns-benefits\/26006\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/secure-dns-private-dns-benefits\/28454\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/secure-dns-private-dns-benefits\/27611\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/secure-dns-private-dns-benefits\/34699\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/secure-dns-private-dns-benefits\/47209\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/secure-dns-private-dns-benefits\/20191\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/secure-dns-private-dns-benefits\/20820\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/secure-dns-private-dns-benefits\/29824\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/secure-dns-private-dns-benefits\/25875\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/secure-dns-private-dns-benefits\/31583\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/secure-dns-private-dns-benefits\/31298\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/me-en.kaspersky.com\/blog\/tag\/tips-2\/","name":"tips"},"_links":{"self":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/20711","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/2722"}],"replies":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=20711"}],"version-history":[{"count":1,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/20711\/revisions"}],"predecessor-version":[{"id":20712,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/20711\/revisions\/20712"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/20713"}],"wp:attachment":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=20711"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=20711"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=20711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}