What plain DNS leaks
A traditional DNS query is a UDP packet sent on port 53, unencrypted. Anyone on the path — your mobile carrier, the coffee-shop router, a middlebox — can log every domain: your bank, your health searches, every news site. Even with HTTPS everywhere, the names you resolve remain exposed. This is DNS snooping, and it is the cheapest surveillance method that exists.
DoH vs DoT: two encodings of the same idea
| Property | DNS-over-TLS (DoT) | DNS-over-HTTPS (DoH) |
|---|---|---|
| Encryption | TLS wrapper on port 853 | HTTPS request on port 443 |
| Blend-in factor | Detectable as DNS traffic | Indistinguishable from web traffic |
| Android support | Built-in "Private DNS" setting | Via firewall apps (NULLOG) |
| Best for | Simple system-wide setup | Maximum censorship resistance |
Both encrypt the query; the difference is the wrapper. DoT is a dedicated DNS channel — cleaner to policy-manage, but visible as DNS on port 853. DoH hides inside ordinary HTTPS, making interception or blocking far harder. Android supports DoT natively; full DoH control comes from a filtering firewall.
Enable it in two minutes
- System DoT: Settings → Network & Internet → Private DNS → enter a provider hostname such as
one.one.one.one(Cloudflare) ordns.quad9.net(Quad9). - Full DoH + filtering: install NULLOG and open the Encrypted DNS tab. Pick Cloudflare (1.1.1.1), Quad9 (9.9.9.9), AdGuard DNS, or paste any custom DoH endpoint.
- Verify: the tab shows the live resolver status, TLS 1.3 state and a DNS-leak check — "0 DNS leaks detected" is what you want to see.
What encrypted DNS does and does not hide
Encrypted DNS stops name-resolution snooping — the most complete single record of your activity. It does not hide which IP addresses you connect to (the destination servers still see you) and does not anonymize you to the sites you visit. For most threat models, though, the DNS log is the highest-value leak, and closing it takes minutes.
Put it into practice with NULLOG
NULLOG runs every technique in this guide locally on your Android — ads, trackers and telemetry filtered in device memory. No root. No cloud. No logs.
Download NULLOG APK (v1.0.2)