DNS Encryption: Does Cloudflare Stop ISP Snooping?

No, Cloudflare alone does not stop your ISP from reading your DNS queries; you need to enable DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) in your browser, operating system, or router. Even then, your ISP can still see the IP addresses of the websites you visit, but they cannot see the domain names you look up.

What Cloudflare Actually Does

Cloudflare runs one of the world’s largest public DNS resolvers (1.1.1.1). When you type a website name, your device asks a DNS resolver to translate it into an IP address. By default, that request is sent in plain text, meaning anyone on the network path—including your ISP—can read it. Cloudflare’s service itself does not encrypt your DNS traffic unless you specifically configure your device to use its encrypted endpoints (DoH at https://cloudflare-dns.com/dns-query or DoT at tls://1.1.1.1).

Even when you use Cloudflare’s encrypted DNS, the ISP still sees the destination IP address of every connection you make. If you visit example.com, the ISP may not see the query for example.com, but they will see traffic to the IP address that serves it. Because many sites share IPs (via CDNs), the ISP might not know exactly which site you visited, but for smaller sites with unique IPs, they can often guess.

How DNS Encryption Works

DNS-over-HTTPS (DoH) sends your DNS queries inside an HTTPS connection, typically on port 443. This hides the queries from anyone who can see your network traffic. DNS-over-TLS (DoT) does the same but uses a dedicated port (853) and a TLS connection. Both prevent your ISP from reading the domain names you request, but they do not hide the IP addresses you connect to afterward.

To use them, you need to change your DNS settings:

In your browser: Firefox and Chrome have built-in DoH settings. In Firefox, go to Settings → Network Settings → Enable DNS over HTTPS. In Chrome, go to Settings → Privacy and Security → Security → Use secure DNS.
In your operating system: Windows 11 and macOS have options to set DoH for your network adapter. On Windows, go to Settings → Network & Internet → Wi-Fi/Ethernet → DNS server assignment → Edit → set to Manual and enter 1.1.1.1 with DoH enabled. On macOS, go to System Settings → Network → your connection → Details → DNS, add 1.1.1.1, then enable the “Limited” or “Automatic” DoH mode.
On your router: Many routers now have a “DNS over TLS” or “DNS over HTTPS” option. If yours does, enter Cloudflare’s settings there. This encrypts DNS for all devices on your network.

What Your ISP Can Still See

Even with DoH/DoT, your ISP can see:

The IP addresses of the servers you connect to (the destination IP).
The amount of data transferred.
The timing and frequency of your connections.
If you use a VPN, they see only the VPN server’s IP, but not the content.

They cannot see the domain names in your DNS queries, but they can often infer them from the IP addresses. For example, if you connect to 192.0.2.1, and that IP is known to host example.com, the ISP can guess you visited that site. However, if the site is behind a CDN like Cloudflare, the IP might be shared by thousands of sites, so the ISP only knows you visited “some Cloudflare-hosted site.”

How to Choose the Right DNS Setting

To actually prevent your ISP from reading your DNS, you must:

Choose a DNS provider that supports DoH/DoT (Cloudflare, Google, Quad9, etc.).
Configure your device or router to use that provider’s encrypted endpoint.
Verify that the setting is active (you can use online tools or check your browser’s DNS settings).

If you only use Cloudflare’s regular DNS (1.1.1.1 without encryption), your ISP can still read your queries. The encryption is the key, not the provider.

Common Problems and Misconceptions

“I use Cloudflare, so my ISP can’t see anything.” This is false unless you enable DoH/DoT. The default DNS in most browsers is still plaintext unless you change it.

“DoH/DoT makes me completely anonymous.” No, it only hides DNS queries. Your IP address and traffic patterns are still visible.

“My ISP can’t see my DNS if I use a VPN.” Correct, but the VPN provider sees your DNS queries instead. You must trust the VPN provider.

“Enabling DoH slows down my internet.” Usually not; the overhead is minimal. However, some ISPs may throttle or block DoH traffic because they can’t cache it. If your internet seems slower, try a different DoH provider or port.

Comparing DoH and DoT

DoH (DNS over HTTPS) uses the same port as regular web traffic (443), which makes it harder to block. DoT (DNS over TLS) uses a dedicated port (853) that is easier to block but simpler to implement. Both are equally secure; the choice often depends on your network environment. If your ISP blocks port 853, DoH will still work. If your router only supports DoT, use that.

Costs and Alternatives

Encrypted DNS is free for most providers, including Cloudflare, Google, and Quad9. There are no costs to you. Alternatives to Cloudflare include:

Google Public DNS: DoH at dns.google/dns-query, DoT at dns.google.
Quad9: DoH at dns.quad9.net/dns-query, DoT at dns.quad9.net.
NextDNS: Customizable DoH/DoT with filtering.

You can also run your own DNS resolver (like Pi-hole) and encrypt its upstream queries, but that requires technical setup.

Frequently Asked Questions

Does Cloudflare 1.1.1.1 encrypt my DNS by default?

No. The plain 1.1.1.1 service sends DNS queries in plaintext. You must explicitly enable DoH or DoT in your device settings.

Can my ISP see my browsing history if I use DoH?

They can see the IP addresses you connect to, but not the domain names. If a site’s IP is unique, they might infer the site. To hide IPs, you need a VPN or Tor.

How do I check if my DNS is encrypted?

You can visit a site like 1.1.1.1/help (Cloudflare’s help page) which shows whether your DNS is using DoH/DoT. Alternatively, use a network analyzer like Wireshark.

Will encrypted DNS stop my ISP from selling my data?

It stops them from selling your DNS query data, but they can still sell aggregated data about your IP connections and traffic volumes.

Is it better to use DoH or DoT?

For most users, DoH is easier because it works through firewalls that allow HTTPS. DoT is simpler but can be blocked. Both are secure.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →