What Is Secure DNS? And Why It Skips Your Ad Blocker

Secure DNS is the setting in Chrome, Edge, Brave and Firefox that encrypts your browser's DNS lookups, the step where a site name like example.com is turned into an address. Normally those lookups travel in plain text, so anyone on your network (or your internet provider) can see which sites you visit. With secure DNS on, the browser sends them over HTTPS instead, using a standard called DNS over HTTPS (DoH). It's a genuine privacy improvement, with one side effect worth knowing: a browser using its own secure DNS goes straight past any DNS-level ad blocker or family filter on your PC.

What secure DNS means, in plain terms

Every time you open a site, your browser asks "what's the address for this name?" Traditionally that question goes, unencrypted, to whatever DNS server your network hands out, usually your router or your provider.

Secure DNS changes two things:

• It's encrypted. The lookup is wrapped in HTTPS, like a normal secure web request, so it can't be read or altered on the way.
• The browser picks the resolver. Instead of asking the PC's DNS, the browser can talk to a provider directly: Cloudflare, Google, Quad9, NextDNS, or whatever you choose.

That second point is where the trouble starts.

Secure DNS settings in each browser

• Chrome: Settings → Privacy and security → Security → Use secure DNS
• Edge: Settings → Privacy, search, and services → Security → Use secure DNS
• Brave: Settings → Privacy and security → Security → Use secure DNS
• Firefox: Settings → Privacy & Security → DNS over HTTPS

In Chromium browsers you'll see two modes. The default, with your current service provider, keeps using the PC's own DNS setup where it can. Choosing a specific provider makes the browser always resolve names itself, ignoring the PC's DNS entirely.

Why secure DNS can bypass a DNS ad blocker

A DNS ad blocker works by answering the PC's lookups and refusing ad, tracker and malware domains. Our explainer on what DNS filtering is covers how. If a browser is set to send its lookups straight to an outside provider over encrypted DNS, the blocker never sees them, so it can't block anything in that browser. Every other app stays filtered; that one browser shows ads again.

The same applies to SafeSearch and YouTube Restricted Mode enforced at the DNS level: a browser on its own secure DNS escapes them.

How AdBolish handles it

• Automatic mode is covered. AdBolish's Encrypted DNS bypass list, on by default, blocks the well-known secure DNS services. Browsers in their default automatic mode then fall back to the PC's DNS, which is AdBolish. Firefox is also told not to switch DoH on by itself.
• A forced provider gets a banner. If you or your organisation set a browser to always use a specific provider, AdBolish says so plainly, for example Chrome isn't protected. It uses its own secure DNS, so AdBolish never sees what it looks up, and tells you where to switch it off. Turn it off, restart the browser fully, then click Check again.
• Chrome and Edge can be done for you. In Settings ▸ Protection, Turn off secure DNS in Chrome and Edge handles both. It needs administrator rights, and while it's on, both browsers show "Managed by your organization", because that's how Windows applies the setting. Your previous browser settings come back when you turn it off or quit AdBolish.

If the banner says the setting is set by your organisation, only an administrator of that PC or organisation can change it.

Should secure DNS be on or off?

It depends on what else is on your PC:

• Nothing filters DNS on your PC? Leave secure DNS on. It stops your network from reading your lookups.
• You use a DNS ad blocker, family filter or security filter on the PC? Use automatic mode or turn it off in the browser, so lookups go through the filter.

You don't actually have to choose between privacy and filtering. AdBolish's Encrypted DNS setting encrypts the lookups it forwards, for every app on the PC, not just one browser. Pick Quad9 or Cloudflare (DNS over HTTPS), enter a NextDNS profile ID, or add a Custom DoH URL. The default is Off (your network's DNS). So the browser can use the PC's DNS, AdBolish filters it, and what it doesn't block still leaves encrypted.

Secure DNS vs. DNSSEC, DoT and VPNs

• DNSSEC signs DNS answers so a resolver can check they're genuine. It doesn't encrypt anything.
• DNS over TLS (DoT) encrypts lookups like DoH, but on its own dedicated port, which makes it easier for a network to spot and block. DoH blends in with ordinary web traffic.
• A VPN encrypts all your traffic, not just lookups, and hides your IP address from sites. Secure DNS does neither of those.

Quick troubleshooting

• One browser still shows ads, the rest don't. It's almost always secure DNS set to a specific provider. Switch it off and fully restart the browser, including any windows left running in the tray.
• "Managed by your organization" appeared in Chrome or Edge. That's Turn off secure DNS in Chrome and Edge in AdBolish. Turn it off to remove it.
• A site broke after you changed the setting. That's ordinary blocking, not secure DNS. Our guide to turning off an ad blocker for one site covers the fix.

AdBolish filters DNS for every app on your Windows PC, flags any browser that slips past it, and can encrypt the lookups it allows. Read more on the system-wide blocking page.