Encrypted DNS on the router - cover the whole household

Browsers and phones let you turn on encrypted DNS individually, but a household has devices with no settings at all - TVs, game consoles, smart speakers - that resolve names through whatever the router hands them. Fixing DNS at the router means every device gets the same protection with one change, which is precisely the "whole home" problem [1].

This guide covers the three levels: router DNS settings, per-brand DoT/DoH support, and a local proxy that brings encryption to older routers. It assumes you own the router - on a school, work or rented network, this is the administrator's call, not yours [7].

What "DNS on the router" really does

Your router assigns a resolver address to every device via DHCP. Most devices then use it on the router's behalf, and the router itself forwards to an upstream resolver [1]. Setting encrypted DNS at the router means that forward happens over DoT (TLS on port 853) or DoH (HTTPS on port 443) instead of plaintext [4][5]:

• Devices with their own browser DoH (Firefox, Chrome, Edge) keep using their own setting regardless - encrypted DNS at the router is the floor, not a ceiling.
• Devices without settings (TVs, consoles) now resolve through the encrypted upstream - this is exactly what you cannot get any other way.

Level 1: change the DNS upstream in the router admin

Every router lets you set upstream DNS - the question is whether it can do it encrypted [1]:

1. Log into the router admin (usually the gateway IP, e.g. 192.168.1.1) and find the WAN or Internet settings.
2. Set DNS servers to a public resolver: 1.1.1.1 / 1.0.0.1 (Cloudflare), 8.8.8.8 / 8.8.4.4 (Google), or 9.9.9.9 (Quad9) [1].
3. If the router offers a "DNS over TLS" or "DNS over HTTPS" toggle next to it, turn it on and provide the provider's hostname (one.one.one.one, dns.google, dns.quad9.net) [1][4]. If it does not, you are doing plain DNS - make Level 3 estimates.

This beats DNS-layer blocks for the whole household via a real provider policy, exactly like the per-device resolver change but once.

Level 2: per-brand support

Practically, router support for encrypted DNS splits into:

• None - most home routers only do plain DNS (they still fix simple DNS blocks, but can be intercepted; the RFC 7626 note on network interception from our resolver guide applies).
• DoT only - newer routers expose a "DNS over TLS" field with a hostname [4].
• DoH - a growing number, especially custom-firmware or business routers, expose DoH.

Check the "encrypted DNS" setting under the router's WAN/DNS section - if present, prefer DoH (it hides better on port 443; our DoH article explains why) and use the simple hostname (one.one.one.one) so you are not chasing IP blocks [1][5].

Level 3: a proxy for older routers

When the router has no encrypted-DNS setting but can run packages (OpenWrt and similar custom firmware), install a proxy such as dnscrypt-proxy: it listens locally, forwards every device's lookups over DoH/DoT/DoQ, and runs on modest hardware [2][3].

• Install dnscrypt-proxy on the router (or on a small always-on Raspberry Pi as your DHCP DNS).
• Point the router's upstream DNS at the proxy's local address (usually 127.0.0.1 on the router).
• Configure it to use DoH or DoT to one of the public resolvers above [3].

The proxy route is the honest solution for household setups where plain upstream forwarding is not enough [2][3].

Verify before you close the settings

1. On a device with no browser DoH - a phone on the household Wi-Fi - open the 1.1.1.1 help page [6]: under "DNS over HTTPS" or "DNS over TLS" it should read Yes, and under "Resolver IP" it should show the public resolver, not your ISP.
2. On a TV or console (no browser): load a normally blocked site - success there is the whole point.
3. Re-test the sites from our site pages after 24 hours to catch any stale resolver cache.

Honest limits

• Does not cover every device's privacy. TVs and consoles now use the encrypted upstream, but browsers that already had their own DoH stay on it; a router-level change cannot override a stricter device setting [1].
• Router firmware is the weak link. Some routers quietly fall back to plain DNS or include their own filter that beats a DoT setting; check the actual outgoing connection, not the checkbox [7].
• Shared households should agree. Changing DNS for everyone is a visible change with privacy implications; make it openly, not by stealth [7].

A legal note, as everywhere on this site: encrypted DNS is legal in most places, but on managed networks it may conflict with the administrator's rules. This guide is information, not legal advice [7].