There is a relatively new feature on pretty much all web browsers these days that you
might want to enable if it's not already, it goes by a few names.
Encrypted DNS is one.
Secure DNS or also private DNS.
DNS stands for domain name system and basically it's just the conversion that your web browser
makes when you type in a URL, the name of the website.
Your browser has to look up the actual IP address that that name corresponds to, and
it does so using a domain name server.
So it basically contacts the server, "Hey, what's the IP address for this website," and
then the server will send it back, and then the browser connects directly to that server.
But this request back and forth is usually not encrypted, which has a couple of drawbacks.
One, someone could listen in and see which websites you're trying to access simply by
looking at what DNS traffic is going through, even if the actual connection to the website
is encrypted.
And also, if there's someone whose able to perform a man in the middle attack, they could
basically intercept the DNS request and send you back a fake request, which will redirect
you to maybe a scam website or something.
Encrypted DNS was created so basically you know that you're talking to the correct DNS
server and the response you're getting back is real, and also it means that no one can
spy in on that DNS request.
Now, there are two different forms of encrypted DNS.
One is called DNS over HTTPS, and one is called DNS over TLS.
You really don't have to know the difference.
For all intents and purposes, for most people, they're going to be exactly the same.
So just recognize that they might be called different things, but they effectively do
the same thing.
So yes, I am going to show you how to enable encrypted DNS.
It's pretty simple on most web browsers.
On mobile, it's a little bit different, but I'm going to show you all that, and I'll put
the timestamps in the description if you want to skip right to your part.
One quick thing as a heads up, though, if you're going to be using this on a computer
or a browser that's only a school or work network that uses some kind of DNS filtering
for web traffic, this could cause unexpected results.
Because if they do DNS filtering, then they might see this encrypted DNS as an attempt
to get around that, and they might just block your connection altogether.
So if you enable this on a work network and you can't connect to the internet anymore,
you might just not be able to use this, or alternatively, it could actually allow you
to bypass their filters depending on how it's set up.
So just kind of monitor if anything weird happens to your internet and you don't like
it, just disable it again.
Before we get started, as a quick reminder, if you guys didn't know, if you want to get
my videos early, you can actually become a member of my channel here on YouTube.
You get some other perks such as custom emojis that you can use in the comments, a cool badge
next to your name, and some other stuff that you can see here.
And like I said, early videos, usually about a day early.
As soon as I've finished uploading the video and putting it on YouTube, I send out the
unlisted link to members so you can view or comment on it first, if you want.
If you're on desktop or Android, you can just click that join button.
If you're on iOS, you're going to have to go over to a desktop to join, because Apple
takes a really huge cut.
YouTube doesn't enable joining on iOS because of that.
So if you want to support the channel, you can do that.
But in any case, let's continue.
What I'll do is I'll first go over how to enable it on individual web browsers on desktop,
then I'll talk about how to enable it on your phone or mobile devices that applies to the
entire phone, and then we'll talk about how to enable it on desktop for the entire computer.
Now, to make sure it works before and after, you can actually use Cloudflare's DNS checker
to see if it's already enabled.
So if you go to the link in the description, I'll put it right here, it will basically
tell you which of the things are enabled and you can see all the way on the left encrypted
DNS is not by default probably.
Alternatively, you can just go to 1.1.1.1/help.
That's also run by Cloudflare.
It's a little bit different interface, but it breaks it down even by HTTPS or TLS.
You can look at there too.
And that one might be a little bit easier to remember.
All right.
So first, let's go over how to enable encrypted DNS on all the different major web browsers,
which pretty much all support it.
So first, let's do Chromium-based browsers.
This is going to be like Microsoft Edge, Brave Browser, Google Chrome, of course, and Chromium.
They're all based on the same thing.
For Google Chrome, you go to settings, and then privacy and security, and then under
security, and then secure DNS.
You check it to enable it, and then select the different provider.
I would just recommend Cloudflare 1.1.1.1 That's the one I use and they kind of pioneer
a lot of this encrypted DNS stuff, so they're a decent one to use.
In other Chromium-based browsers, it might be slightly different location for the setting,
but the setting will be there.
For example, in Edge, it's in settings and then "privacy search and services", and then
under security.
So if you can't find it in another Chromium browser, just look for like a settings area
called security or something, and then look for secure DNS or encrypted DNS.
Next, for Firefox, it's a pretty similar story.
You go to options, and then stay in the general tab, and then scroll down to the bottom where
it says network settings.
And then at the bottom of that menu that pops up, you check the thing that says enable DNS
over HTTPS.
And then again, you can select Cloudflare or whatever one you want.
There's other services out there now too.
So then after you enable it in the browser, you can go back to the test website and it
should say that encrypted DNS is enabled.
All right.
So as you saw, really easy to enable it on individual browsers on desktop.
Now let's go over how to enable it across your entire phone.
On Android, the feature is actually called private DNS, and this should be available
in pretty much most of the more recent major versions of Android you should have.
Depending on your phone's manufacturer, the location of the setting might be slightly
different, but generally, you can just go into settings and then look for where it says
network settings, or it might be called something different.
For example, in Stock Android, it's called network and internet.
On Samsung, it's called connections.
Something like that.
Next, on Stock Android, you go to what it's called advanced settings.
And for Samsung, it's called more connection settings.
Again, look for something that expands more settings.
And then in there you can actually look for where it says private DNS.
And when you tap it, you'll probably see three options: off, automatic, and then a section
to enter your own custom one.
For some reason, automatic didn't work for me.
So you're probably going to have to enter a custom host name.
And one thing to keep in mind is on Android for some reason, it requires you to enter
an actual host name, so URL, not like an IP address, such as Cloudflare's 1.1.1.1.
You'd have to use the actual host name of that, which is 1dot1dot1dot1, spelled out,
.cloudflare-dns.com.
I know it's not exactly easy to type out, but that's what it is.
I think the reason is because the host name supports IPv6.
Whereas if you just put 1.1.1, that's IPv4 and mobile networks require IPv6.
I don't know, something like that.
But anyway, just look up the host name version of whatever DNS server you want to use.
And then you can go on the test site and check if it's enabled or not.
And again, you can use either one.
Next, let's talk about enabling it on iOS and iPadOS.
Now, these do support encrypted DNS natively on the backend.
However, for some reason, apple has not implemented a simple GUI way to add this setting like
they have on Android that we saw.
Instead, what you have to do is create a configuration network profile that you load onto your iOS
or iPad device and then that configures the DNS.
It's not quite as complicated as it sounds, but it is obviously more involved, but still
I'll walk you through it.
And by the way, this might actually change with iOS 15 or future updates.
If you're watching this video years down the line, check the description I might put if
they added this feature more easily.
But if you're watching it today, then you'll have to go through this.
Fortunately, there are some people on the internet who created pre-made configuration
files.
One is a programmer named Paul Miller on his GitHub page.
He made a bunch of pre-made ones for different DNS providers, including Cloudflare and even
specific ones for HTTPS or TLS.
And it is open source, so you can go in there and look exactly what the code is.
Make sure there's nothing weird in there and other people have presumably looked at it
too.
The first thing to do is go to this page, and I'll put the link in the description,
and make sure you access it from the actual device that you're going to be installing
this profile onto.
So if you're on your phone, then you have to go on your phone to the site.
Just pick one of the files, whichever applies to you the most.
You can just do the "Cloudflare-https" one.
That one's fine.
Next, on this page that has the code on the mobile version at least, you tap the three
dots and then tap "view raw", which will link directly to the actual file.
It'll then ask you if you want to download the configuration profile.
You hit allow.
But realize this won't actually install it yet, it just downloads it.
So next, what you need to do is go into the settings app.
And then near the top, you'll see this new menu pop-up that says profile downloaded.
Click into that.
Here you'll be able to see some more details about the profile you downloaded, including
what settings were changed.
You'd go in and see that it changes some DNS settings, and that includes the URL for the
DNS host.
But anyway, here you just click install, and then it'll give you a warning, and then you
click install again and now it should be set.
So now you'll be able to see that this was installed by going to "general" and then under
"profile" and you can see all the profiles installed here.
This is also where if you ever wanted to, you could uninstall it, you just remove the
profile from it here, if you want.
So now, again, you can go back into Cloudflare's DNS checker site, either one, and see if it
worked.
And if I go to the 1.1.1/help site, I can specifically see that it did enable DNS over
HTTPS, which is the profile I downloaded.
Now I should point out that there are apps out there that will allow you to connect to
encrypted DNS, but it does it a little bit differently.
Instead of doing it natively through the operating system, like we just did, the apps such as
Cloudflare's "1.1.1.1" app will basically create a VPN profile.
So it's like a local VPN where it kind of redirects all the traffic on the phone through
the app and then goes out.
But even though that might be easier to do initially, I'd rather not just have a VPN
profile active all the time.
That might interfere with other VPN software I'm using and stuff like that.
I'd rather just do it natively through the operating system, which is what we did.
Now, let's talk about enabling encrypted DNS on the entire computer, on a desktop, so for
example, Windows and Mac.
macOS does support encrypted DNS and is basically actually a very similar process to what we
just did on the iOS.
You have to, again, download a mobile app file on macOS and actually you download the
exact same profile.
So if you downloaded CloudFlare HTTPS for iOS, you can download the exact same profile,
install it on your Mac.
So again, what you could do is go onto that GitHub page again, click on the one you want.
But then this time, what you have to do is control click on where it says "raw", and
then click "download linked file as", and then choose to put it wherever.
You will have to rename it to take off the .txt file extension.
For some reason, when you download it, the Mac will add that text file extension, which
you have to remove.
But then wherever the file goes, you just double click it and then it will bring up
the profile menu, and then you can click continue and then install from there.
And then just like on iOS, it should work right away.
All right.
Now for Windows though, unfortunately Windows does not support you encrypted DNS yet for
the entire operating system.
They have implemented the feature in "insider" or beta versions of Windows basically, but
that's the only people who have signed up to receive those beta versions.
Hopefully this feature will be implemented in the next major feature update, which will
be probably near the end of 2021.
So if you are watching from the future, then you can see here this might be where the setting
will be accessible, just right in the network settings and then you go to network adapter
properties.
It might allow you to enter an encrypted DNS setting right there.
But again, otherwise, you can still just enable it on the browser level and it'll still work
for that.
All right.
That's how to set up encrypted DNS on basically all your devices, but you may have caught
one thing, which is no matter how you set it up, on the test checker page, you'll probably
see that all the way the right, it says ESNI, something called ESNI is not enabled.
There's a red check.
That's actually more of an upcoming feature.
Not really something you have to worry about right now, but let me explain it anyway if
you're interested.
Basically encrypted DNS is great, but it's not perfect.
You see, when you make a request DNS server, that will be encrypted so the ISP or whoever
can't actually snoop in on what DNS request you're making.
But the thing is, when you go to actually access that website directly, there are requests
to the site that initiate handshake that are done in the clear.
Even though they can't see the DNS request you're making, they can still see which websites
exactly you're accessing.
And this part of the handshake before it's actually all encrypted is called server name
identification or SNI.
Enter two new technologies known as ESNI and ECH.
First is ESNI or encrypted SNI.
Basically no browsers actually support this at the moment.
Strangely, Firefox previously did support ESNI, but they removed the feature to replace
it with ECH, which I'll talk about next.
However, you can actually get the Firefox Extended Support Release or ESR if you want
to get ESNI.
You just have to download that special version of Firefox, and then also actually enable
some experimental tags in the about:config menu, and then you'll be able to use ESNI.
You can see when I run the Extended Support version of Firefox and enable those, I can
get all four checkmarks enabled.
But again, no other browsers that I'm aware of support ESNI.
So don't worry about that checkmark being green because it's already kind of experimental
feature.
It's not really a finalized thing yet.
There is the other one though, ECH, which stands for "encrypted client hello", and this
is actually an improvement on ESNI.
So ESNI will probably never be a thing.
And most web browsers, once this is all finalized, will probably use ECH.
Now, the current release of Firefox does support ECH, and they, again, replaced ESNI with this.
But in my opinion, this was very dumb, because literally no sites that I'm aware of support
ECH at all.
I mean, even the Cloudflare DNS checker that checks for ESNI doesn't even check for ECH.
So literally the people who are pioneering the ECH protocol don't check for it.
So literally nothing uses it.
Okay, yeah, it's great that Firefox added this feature for the future, but why did they
remove ESNI that can actually be used and is actually used by several websites?
Anyway, you might be wondering how this ESNI and ECH work.
I mean, if you're talking to your ISP and you want to access a website, your ISP has
to make that connection.
How can they possibly not know what website you're asking for if they're the ones that
connect you to that website?
And the answer is pretty interesting.
Many websites are behind what is called a content delivery network or CDN.
Cloudflare is a major example of this.
Another one is Imperva Incapsula.
I think they're another company.
Basically, they're a service where you kind of put your website behind their network,
almost like a firewall.
So instead of people, when they go to your URL, instead of them accessing your server
directly, they access a cache version that Cloudflare hosts.
And this has a few benefits.
First of all, Cloudflare has servers all over the world.
So when someone, no matter where they are, tries to access your site, they can access
the fastest version, which is a very close version of CloudFlare server instead of yours,
which might be across the world.
Also, this adds a barrier for if hackers want to try and DDoS your website or something
like that, then they're going to be DDoSing the whole Cloudflare network, which is very
much set up to block DDoS attacks and hacks and stuff like that.
It's called a web application firewall.
But the important point of all this is because all of these sites are hosted on Cloudflare
or behind Cloudflare, They all kind of have either a same or very similar group of IP
addresses.
So basically because you encrypt your initial DNS request with Cloudflare or whatever, then
your ISP will not be able to snoop in and see what DNS requests you're making.
So to the ISP, they can only see that you're accessing some website on Cloudflare's network,
which could be one of millions, but they can't see exactly which website you're accessing.
The one thing to remember though is I believe this is probably only going to work for websites
that are behind some kind of content delivery network.
If you're accessing a website where it has its own server, then obviously there's probably
no way to get around the ISP seeing where you're connecting to.
But still, for many websites, it'll still be a help.
So yeah, that might've been more knowledge than you're bargaining for, but at least now
you know how to enable this security feature.
And again, if things start acting weird, you lose your connection or whatever, you can
always just disable it by undoing these settings we changed.
So like I mentioned before, if you guys want to become a channel member, you can get my
videos early, get emojis, and a cool badge.
You just click the join button, or if you're an iOS, you can just do it on desktop, or
I, of course, always just appreciate if you give it a thumbs up and leave a comment.
Let me know your thoughts.
If you guys want to keep watching, the next video I'd recommend is about a new telephone
scam that's going around that is very interesting.
And you might want to watch it because it's one of those scams where you can do nothing
wrong and still get scammed.
So definitely check it out right there.
You can just click on it.
So anyway, thanks for watching, guys, and I'll see you in the next one.