What DoH and DoT protect
RFC 7858 defines DNS over TLS between a device and its resolver, on TCP port 853 by default, and port 853 must not carry cleartext DNS. TLS encrypts queries and answers against eavesdropping and tampering on the path. [1]
RFC 8484 defines DNS over HTTPS, which maps each query and answer onto an HTTPS exchange. It says DoH encrypts DNS traffic and requires the server to be authenticated. That helps against passive surveillance and against attempts to divert DNS to a rogue server. Cloudflare's DoH docs add that DoH uses port 443, so it is hard to tell apart from normal browsing. [2][3]
What it does not hide
Cloudflare's post on Encrypted Client Hello says SNI tells the network which server you want to reach. It calls SNI the clearest signal of which server a client is talking to. Cloudflare adds that the origin's IP address is another clue, though sharing an IP with other sites makes it less precise. [4] Encrypted DNS fixes the lookup, not the connection that follows. A VPN hides destinations from the local network, but then the VPN provider sees them instead.
| Still visible | To whom | Source |
|---|---|---|
| Every name you look up | The resolver you send queries to (it is the endpoint of the encrypted connection) | Follows from RFC 7858 and 8484 scope [1][2] |
| Your IP address | The resolver; RFC 8484 notes the client address provides obvious correlation information | [2] |
| Site name in the TLS handshake (SNI) | Anyone on the path, unless Encrypted Client Hello is used | [4] |
| Destination IP addresses | Anyone on the path; shared IPs make this less precise | [4] |
| Timing and message sizes | A well-placed observer; padding is a partial fix | [1] |
Router-level or browser-level
Setting encrypted DNS on the router covers every device, including TVs and consoles that have no such setting. On GL.iNet firmware it is under DNS. Firmware 4.9 to 4.10 and 4.11 offer named providers including Cloudflare, Quad9, NextDNS, Control D, AdGuard DNS, Google DNS, OpenDNS and CleanBrowsing. They also have a Manual option for DoT, DoH, DoQ, Oblivious DoH or DNSCrypt. [5][6]
The router encrypts from itself to the resolver. Lookups from your devices to the router stay on your local network. Override DNS Settings of All Clients redirects devices that try to use their own unencrypted DNS. GL.iNet describes it as covering unencrypted DNS, so a browser that already sends its own DoH keeps bypassing the router. [6]
Browser-level DoH protects that browser even on networks you do not control. That is useful on a laptop that also travels without your travel router.
Interaction with a VPN
On firmware 4.11, VPN-policy traffic uses the DNS servers provided by the VPN tunnel by default, and non-VPN traffic uses the WAN's DNS. If you set manual DNS, the Apply Manual DNS to VPN tunnels toggle makes tunnel traffic use it instead. Apply Manual DNS to Router Itself is on by default. [6]
On firmware 4.10 and earlier, the equivalent setting is Allow Custom DNS to Override VPN DNS. Leaving the VPN's DNS in place is usually the simpler choice, because it keeps lookups inside the same tunnel as the traffic. [5]
Captive portals and travel routers
Hotel and airport Wi-Fi often makes you sign in on a web page first. GL.iNet says DNS Rebinding Attack Protection can make private DNS lookups fail, and should be turned off if your network uses a captive portal. On a travel router such as Beryl AX, this is the first setting to check when the sign-in page will not load. [6]
A practical order on the road: connect, complete the portal sign-in, then turn on encrypted DNS or the VPN. If DoT on port 853 does not connect on a restrictive network, try DoH. RFC 8484 points out that DoH shares the HTTPS port, so it is harder to single out. [2]
Checklist: prove it is working
- On the router's DNS page, check the WAN DNS and VPN DNS status lists and confirm which servers are in use. [6]
- If you chose Cloudflare, open the 1.1.1.1 help page (https://1.1.1.1/help). Cloudflare says it shows whether your connection to 1.1.1.1 is working and which data center is serving you. [7]
- Check each browser's secure DNS setting so you know whether it uses its own resolver.
- Turn on Override DNS Settings of All Clients if you want devices with hard-coded plain DNS to go through the router. [6]
- After any firmware upgrade, recheck the DNS page, because options moved between 4.10 and 4.11. [5][6]
Questions before you decide
Is DoH more private than DoT?
They encrypt the same thing. GL.iNet notes DoT uses a dedicated port, which makes it easy to identify on a network, while DoH mixes in with normal HTTPS. RFC 8484 says using port 443 makes interference and traffic analysis harder. Neither hides your queries from the resolver itself.
Does router encrypted DNS override my browser's own setting?
Not necessarily. GL.iNet's Override DNS Settings of All Clients option is described as overriding unencrypted DNS settings. A browser or app already using its own encrypted DNS keeps doing so, so decide which layer you want in charge.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- IETF RFC 7858: DNS over Transport Layer Security (TLS) Accessed 30 Oct 2026
- IETF RFC 8484: DNS Queries over HTTPS (DoH) Accessed 30 Oct 2026
- Cloudflare 1.1.1.1 docs: DNS over HTTPS Accessed 30 Oct 2026
- Cloudflare blog: Good-bye ESNI, hello ECH Accessed 30 Oct 2026
- GL.iNet Router Docs 4: DNS (firmware v4.10 and earlier) Accessed 30 Oct 2026
- GL.iNet Router Docs 4: DNS (firmware v4.11) Accessed 30 Oct 2026
- Cloudflare 1.1.1.1 docs: Check connection Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.