Trace your commute

Practical DNS privacy

Review encrypted DNS settings, fallback and resolver logs

Review desktop Chrome, Firefox and Android Private DNS settings, then read the selected resolver's retention policy without treating encrypted lookups as complete browsing privacy.

Sources checked .

Conceptual illustration

Identify the resolver as well as the encryption setting

Mozilla's explanation distinguishes encrypting a lookup from trusting the receiving resolver. Review the configured provider's own policy. A provider name alone does not answer what it records or retains. Mozilla: encrypted DNS scope

Review desktop Chrome's mode and provider

Google documents Chrome > Settings > Privacy and security > Security > Use secure DNS. Review the provider and whether automatic or custom behavior is selected. The help says managed devices or parental controls can make the feature unavailable. Follow the organization's network policy; do not try to bypass those restrictions. Google: desktop Chrome Secure DNS and fallback

Review Firefox status before changing a protection level

Mozilla documents Settings > Privacy and security > DNS over HTTPS > Advanced settings. Check the displayed provider, level and status. Read warnings and network requirements before changing a mode or exception. Mozilla: DNS protection settings

Review Android Private DNS in device settings

Google documents Settings > Network & internet > Private DNS, or searching Settings for Private DNS. Options include Off, Automatic and a provider hostname. Confirm the intended provider's published instructions before entering a hostname. Menus can vary; the help notes some steps require Android 12 or later. This control protects DNS, not every data flow. Google: Android network, Private DNS and randomized address settings

Read both short-lived and longer-lived resolver records

Google Public DNS distinguishes temporary IP-and-query logs from sampled permanent logs with city or regional information. Check both parts of a resolver notice, including exceptions. A temporary-log deadline should not be presented as deletion of every record associated with using the service. Google: Public DNS temporary and permanent logs

Check the exact resolver product and its exceptions

Cloudflare's cited notice is for its public resolver. Review its 25-hour resolver-log provisions together with the separate packet-sampling and APNIC research provisions. Do not automatically apply that notice to a business filtering product or another service sold under the same company name. Cloudflare: public resolver logs and exceptions

Questions and answers

Does Firefox Max protection silently use the normal resolver on failure?

Mozilla describes a warning and an explicit domain-exception option. Mozilla: DNS protection settings

Does Android Private DNS protect all phone activity?

Google explicitly limits its protection to DNS questions and answers. Google: Android network, Private DNS and randomized address settings

Does this guide require changing DNS or testing private browsing history?

No. The cited controls and provider notices can be reviewed before deciding on a change. Google: desktop Chrome Secure DNS and fallback · Google: Android network, Private DNS and randomized address settings

Sources and scope

Public desktop Chrome, Firefox and Android help checked 10-24-2026. Organization policies, supported software and provider-specific instructions affect available controls.

Keep exploring