What a DNS resolver is
Every time you open a site, your device asks a resolver "what is the address of this name?". The answer comes back in milliseconds. Whoever runs the resolver sees the question: the site name, when, from which address. It does not see the page contents, but a list of site names over a day is already a diary.
The usual choices
Your provider’s resolver is the default. The public ones differ in speed, filtering and what they promise to keep.
| Resolver | Addresses | What it offers | What it keeps (their policy) |
|---|---|---|---|
| Your provider | automatic | nothing special; sometimes slow or filtered | often tied to your account and kept |
| Google Public DNS | 8.8.8.8, 8.8.4.4 | fast, worldwide | temporary full logs, permanent anonymised stats |
| Cloudflare | 1.1.1.1, 1.0.0.1 | fast; 1.1.1.2 blocks malware, 1.1.1.3 adult content too | deletes query logs within 25 hours |
| Quad9 | 9.9.9.9 | blocks known malware domains | no IP addresses stored |
How to change it
Changing the resolver moves the diary from one company to another; it does not hide it. Steps:
Windows 11
Settings, Network & internet, your connection, DNS server assignment, Edit, Manual, enter the addresses. "DNS over HTTPS" can be switched on there too.
Mac
System Settings, Network, your connection, Details, DNS, add the addresses with +.
Android
Settings, Network & internet, Private DNS, enter the provider’s hostname (dns.google, one.one.one.one or dns.quad9.net). This is encrypted DNS and works on every Wi‑Fi.
Router
In the router’s WAN or DHCP settings, replace the DNS servers; every device at home follows.
What a VPN does with DNS
A VPN carries DNS lookups inside its tunnel to the VPN provider’s resolver. The Wi‑Fi and your provider then see neither the site names nor the addresses. Teal VPN resolves names through its own servers and does not log them; with DNS blocking on, ad, tracker and malware domains are refused before they load. A VPN whose DNS still goes to the provider is "leaking"; our IP leak test shows whether yours does.
What DNS reveals, in one list
Every site name you open and when. Which apps phone home. Which countries’ services you use. Nothing about what you read on a page, that part is encrypted by HTTPS. Choose the resolver, or the VPN, that you would be comfortable giving that list to.
Keep reading
References
Need help with Teal? Contact support.