In short
Secure DNS is the browser and operating system setting that encrypts DNS lookups using DNS over HTTPS. In Chrome and Edge it is labelled Use secure DNS. On work devices it is often disabled or managed because unmanaged secure DNS can bypass the company's DNS filtering; admins can instead point it at their protective resolver by policy.
Get a quote for secure DNS management
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What secure DNS means
"Secure DNS" is the friendly name browsers give to DNS over HTTPS (DoH). With it switched on, the browser sends its DNS lookups to a resolver inside an encrypted HTTPS connection instead of in plain text. The Chromium team described the benefits as authenticity (the browser can check it is talking to the intended DNS provider), integrity (the answer has not been tampered with on the network) and confidentiality (others on a shared connection, such as public Wi-Fi in a library, cannot see which sites you look up).
What secure DNS does not do is decide whether a site is safe. The resolver you send lookups to decides that. A plain public resolver answers almost everything; a protective DNS resolver refuses known-malicious domains and, if you choose, unwanted content categories. So "secure" here means "encrypted in transit", not "filtered".
Secure DNS in Chrome and Edge
Both browsers are built on Chromium and behave in a similar way.
- Where it lives. In Microsoft Edge, Microsoft's support pages place it under Settings and more, Privacy, search, and services, then Security, as the toggle "Use secure DNS". In Google Chrome, Google's help pages place it under Settings, Privacy and security, then Security, in the Advanced section, as "Use Secure DNS".
- Same-provider upgrade. By default Chrome keeps your current DNS provider and only switches to DoH if that provider offers a DoH service, using a built-in list of providers. This keeps services such as family-safe filtering that a provider may offer.
- Fallback. In the default mode, if the DoH connection has a problem, Chrome falls back to your provider's ordinary DNS.
- Custom provider. Users can pick a provider from a list or enter a custom one. That is where the risk lies for an organisation: a user can choose a public resolver that ignores company policy.
Firefox has its own DoH settings and works differently, so treat it separately in your policies.
Why "Use secure DNS" is disabled on a work device
If the setting is greyed out or shows as managed by your organisation, that is usually deliberate and not a fault.
- The browser detected management. The Chromium team states that Chrome disables Secure DNS if it detects a managed environment through the presence of one or more enterprise policies, and Google's help pages say the feature cannot be used on a managed device or with parental controls turned on. Google's policy documentation adds that if the DoH policy is unset on a managed device, DoH queries are not sent. Microsoft documents the same default for Edge.
- Your IT team set a policy. Admins can switch DoH off, or force it on to a specific resolver, and the setting then appears locked.
- Your company uses DNS filtering. If lookups went to a public resolver, the company's protective DNS, safeguarding filter or logging would be bypassed. Disabling the browser's own choice keeps lookups on the company's resolver.
So if you see "Use secure DNS" disabled on a work laptop, check with your IT team before trying to change it. On a personal device, a disabled setting can also mean security software or parental controls are managing DNS.
How admins set secure DNS to use the company resolver
The better long-term answer is usually not to switch secure DNS off, but to point it at your protective resolver. These are the controls the vendors document:
| Platform | Policy or setting | What it does |
|---|---|---|
| Google Chrome | DnsOverHttpsMode and DnsOverHttpsTemplates | Mode off, automatic (DoH with fallback) or secure (DoH only); templates set the DoH resolver URL, required for secure mode |
| Microsoft Edge | DnsOverHttpsMode | The same off, automatic and secure modes; unset on managed devices means no DoH |
| Mozilla Firefox | DNSOverHTTPS enterprise policy | Enable or disable DoH, set the provider URL, lock the setting, exclude domains and control fallback |
| Windows | DNS Client Group Policy and DNS settings per connection | Allow, prohibit or require DoH; add your resolver to the known DoH server list |
| Android | Private DNS (DNS over TLS) | Upgrades automatically by default; a hostname can be set; manage with MDM |
These can be deployed through Group Policy for domain-joined machines or through mobile device management such as Microsoft Intune for cloud-managed devices. Two practical points:
- Use your provider's DoH address. You need a DoH template from a protective DNS service that offers one; Cisco, for example, documents a DoH front end for Umbrella's standard DNS service. Many organisations let the provider's roaming agent handle encryption instead; see DNS roaming clients.
- Back the policy with the firewall. Policies cover managed browsers. Apps, unmanaged browsers and malware need the network controls in should you block DNS over HTTPS?
Policy names and behaviour change between browser versions, so check the vendor's current policy list before you deploy, and confirm the result in your DNS security test.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Secure DNS on phones and tablets
Mobile devices have their own versions of secure DNS, and they matter because phones spend much of their time off your network.
- Android has a Private DNS setting, introduced with Android 9, which uses DNS over TLS rather than DoH. By default it upgrades automatically to DNS over TLS when the network's resolver supports it; a user can also enter the hostname of a specific provider, or switch it off. Because it runs on port 853, your firewall can allow it to your resolver and block it elsewhere on your own network.
- iOS, iPadOS and macOS support encrypted DNS settings delivered by device management, from iOS 14 and macOS 11. Apple's developer documentation marks the original DNS Settings profile payload as deprecated from its version 27 releases in favour of a declarative management configuration, so check how your MDM delivers these settings on current versions before you rely on them.
- Browsers on mobiles have their own secure DNS settings in some cases, and managed browser policies vary by platform. Edge's DoH policy, for example, is documented for Windows, macOS and Android but not iOS.
For phones and tablets, a protective DNS agent or a mobile security app that includes secure DNS is often simpler than managing each setting. For example, Lookout's mobile security, now marketed as Lookout Mobile AI Security, includes Secure DNS in its Advanced edition. The NCSC's PDNS Roaming, for eligible public sector bodies, covers iOS as well as Windows and macOS.
Secure DNS vs VPN
People often ask whether secure DNS is the same as a VPN. It is not.
| Secure DNS (DoH) | VPN | Business VPN or SASE with DNS filtering | |
|---|---|---|---|
| What is encrypted | DNS lookups only | All traffic from the device to the VPN server | All or selected traffic to the provider's network |
| Hides sites from the local network | Hides the lookups, not the connections | Yes | Yes |
| Blocks malicious domains | Only if the resolver is a protective one | Not by itself | Yes, where DNS filtering is included and switched on |
| Typical use | Privacy on untrusted networks | Privacy or remote access | Secure remote access plus security policy |
For businesses, the interesting option is the third column: several services we supply combine secure connectivity with DNS filtering, including NordLayer (DNS filtering by category in its Core and Premium plans), Todyl SASE (secure DNS alongside a secure web gateway) and Check Point SASE Internet Access (web and DNS filtering). Our DNS security solutions page compares them with standalone protective DNS.
Is secure DNS management the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How we help
Forever Systems can help you decide whether secure DNS should be on, off or pointed at a protective resolver on your devices, and then roll that out with your existing tools. We can:
- review which browsers and devices are using secure DNS today, and where their lookups go
- recommend a protective DNS service whose resolvers or agents support encrypted DNS
- help set the browser and Windows policies through Group Policy or your MDM
- check the result from the office, from home and on guest Wi-Fi
Contact us to talk it through. Scope and pricing are confirmed at quote.
How Forever Systems helps with DNS security
We are an independent UK IT and cyber security provider and a Cisco Partner. We supply Cisco Umbrella and Cisco Secure Access DNS Defense, and a range of other DNS filtering options, so we can recommend what fits rather than one answer for everyone.
- Start with what you have: we look at your firewall, endpoint protection and Microsoft 365 licences first, as some already include DNS or web filtering
- Choosing a service: Cisco DNS-layer security, DNS filtering bundled with endpoint protection, or a protective DNS service from the public sector, compared in plain English
- Set-up and roll-out: network forwarding, roaming clients for laptops off site, policies, block pages and controls to stop encrypted DNS bypassing the filter
- Migration help, including planning a move from Umbrella DNS packages to Cisco Secure Access DNS Defense
- Ongoing help: policy changes, reporting reviews, licence management and renewals, agreed at quote
We work with businesses, schools, charities and public sector organisations.
Frequently asked questions
What does Use secure DNS do in Chrome and Edge?
It makes the browser send its DNS lookups using DNS over HTTPS, so they are encrypted between the browser and the resolver. By default Chrome keeps your current DNS provider and upgrades to its DoH service if one exists; you can also choose a specific provider.
Why is secure DNS disabled on my work laptop?
Usually because your organisation manages the browser. Chrome disables Secure DNS when it detects enterprise policies, and both Chrome and Edge send no DoH on managed devices unless a policy turns it on. This keeps lookups on your company's DNS filtering and logging.
Is secure DNS the same as a VPN?
No. Secure DNS encrypts only DNS lookups. A VPN encrypts all traffic between the device and the VPN server. Some business VPN and SASE services also filter DNS, which combines the two.
Should I turn on secure DNS?
On a personal device, turning it on with a resolver you trust improves privacy. On a work device, follow your IT team's policy: secure DNS should only be used with the company's protective resolver, or not at all.
Does secure DNS block malware?
Not by itself. Secure DNS only encrypts lookups. Whether malicious domains are blocked depends on the resolver: a protective DNS service blocks them, while many public resolvers do not.
Still have a question about secure DNS management?
Ask us and a member of our team will reply by email.