Encrypted DNS explained: DoH, DoT and why they matter

Plain DNS is readable: anyone on the path can see which domains you ask for. Encrypted DNS fixes that by wrapping lookups in TLS. The two common flavours are DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT).

Why devices are switching it on

Browsers and phones increasingly turn on encrypted DNS by default, pointing at a public provider. That is better for privacy on an untrusted network, but it has a side effect: the local DNS filter no longer sees the lookups, so it cannot block anything.

The way out

The router can serve encrypted DNS itself. The device gets its encryption and its privacy, and the router — which is the one answering — still applies the filter. Blocking public DoH/DoT providers then stops the "just point at someone else" escape.

This is one more case where the enforcement point decides whether filtering holds. For the background, see why DNS-only filters get bypassed.