"This Network Is Blocking Encrypted DNS Traffic": Fix

What Does "This Network Is Blocking Encrypted DNS Traffic" Mean?

"This network is blocking encrypted DNS traffic" means your iPhone, iPad or Mac tried to look up website names through an encrypted DNS server, and the Wi-Fi network stopped it. Apple shows it as a Privacy Warning under the network in Settings > Wi-Fi, with the line: "The names of websites and other servers your device accesses on this network may be monitored and recorded by other devices on this network."

Apple explained it when it added encrypted DNS in iOS 14 and macOS Big Sur (WWDC 2020): some networks block encrypted DNS servers by policy because they filter traffic by looking at DNS queries, and when that happens the Wi-Fi network is marked with a privacy warning.

Your device only tries encrypted DNS when something turned it on: a DNS app (such as Cloudflare's 1.1.1.1, NextDNS or AdGuard), a DNS profile, your employer's device management, or, on iOS 16 and later, a DNS server that offers encryption itself. iCloud Private Relay can trigger it too: Apple's Wi-Fi settings say it routes DNS requests itself. Find that source and you've found the fix.

What Is Encrypted DNS Traffic?

Every time you visit a website, your device sends a DNS query to translate the domain name (like dnsrobot.net) into an IP address. Traditional DNS sends these queries in plain text over port 53 — completely unencrypted. This means your ISP, network administrator, or anyone on the same Wi-Fi can see every domain you look up.

Encrypted DNS wraps these queries in encryption, just like HTTPS protects web traffic. Instead of sending dns-query: dnsrobot.net as plain text, your device encrypts the query so only the DNS server can read it.

There are two main encrypted DNS protocols that Apple devices support:

• DNS-over-HTTPS (DoH) — Sends DNS queries over HTTPS on port 443, so they blend in with regular web traffic
• DNS-over-TLS (DoT) — Sends DNS queries over a TLS connection on dedicated port 853, providing encryption with a clear protocol boundary

Apple devices support both since iOS 14 and macOS Big Sur, but don't use them by default. Since iOS 16 and macOS Ventura they also switch to encrypted DNS on their own when the network's DNS server advertises it through Discovery of Designated Resolvers (DDR). Our Private DNS guide covers the same protocols on Android.

DoH vs DoT: How They Differ

Both protocols encrypt your DNS queries, but they work differently under the hood. Understanding the difference helps you choose the right solution when fixing the blocking issue.

When a network blocks encrypted DNS, the easy target is DoT on port 853. DoH shares port 443 with every HTTPS site, so networks block it by blocking the addresses and names of known DoH servers, or by answering those names with an error.

Why Do Networks Block Encrypted DNS?

Not all encrypted DNS blocking is malicious. There are several legitimate reasons a network might block or interfere with encrypted DNS traffic:

• Corporate/enterprise networks — IT departments block encrypted DNS to enforce security policies, content filtering, and threat detection. They need visibility into DNS queries to block malware domains and prevent data exfiltration
• Parental control routers — Routers with built-in parental controls (like Netgear Smart Parental Controls or ASUS AiProtection) intercept DNS queries to filter content categories. Encrypted DNS bypasses these filters
• ISP content filtering — Some ISPs use DNS-based filtering to comply with government regulations or to block known malicious sites. Encrypted DNS prevents this filtering from working
• Public Wi-Fi captive portals — Hotels, airports, and coffee shops use DNS interception to redirect you to their login page. Encrypted DNS breaks this redirect mechanism
• Pi-hole and AdGuard Home — DNS-based ad blockers need to see your lookups. Pi-hole, for example, by default answers the names devices use to discover encrypted DNS (DDR) and iCloud Private Relay so they stay on it, and some setups add blocklists of DoH servers

On a home network, look first for a feature that filters DNS: parental controls, an ad blocker such as Pi-hole or AdGuard Home, a router security suite, or a firewall rule on port 853.

How to Fix on iPhone & iPad (iOS/iPadOS)

Start with Fix 1: it finds the setting that's trying encrypted DNS. Fixes 2 to 6 clear a stuck connection.

Fix 1: Find What Turned On Encrypted DNS

Check these in order. Each one can make your device try encrypted DNS on every network:

• iCloud Private Relay — it routes and encrypts your DNS lookups itself; Apple's Wi-Fi settings say "DNS requests are being routed by iCloud Private Relay". To stop it on this network only, go to Settings > Wi-Fi, tap (i) next to the network and turn off Limit IP Address Tracking (Apple's way to turn off Private Relay for one network). A network that blocks Private Relay itself shows a separate message saying it isn't compatible with Private Relay
• A DNS app or profile — open Settings > General > VPN & Device Management and look for a VPN or DNS entry from an app (Cloudflare's 1.1.1.1 app installs a VPN profile; NextDNS and AdGuard use DNS settings) or a profile. Turn the app off on this network, or remove a profile you don't need
• Manual DNS servers — under Settings > Wi-Fi > (i) > Configure DNS, servers like 1.1.1.1, 8.8.8.8 and 9.9.9.9 tell iOS 16 and later that they offer encrypted DNS, so your iPhone switches to it automatically. Set Configure DNS back to Automatic to test
• A work profile — if your employer manages the device, its DNS settings are policy: ask IT rather than changing them

Fix 2: Restart Your Device and Router

A restart clears cached network state on both your device and your router.

• iPhone/iPad: Hold the side button + volume button > slide to power off > wait 30 seconds > power on
• Router: Unplug the power cable > wait 30 seconds > plug back in > wait 2 minutes for full boot

After both devices restart, go to Settings > Wi-Fi and tap your network name. Check if the "Privacy Warning" message is still present.

Fix 3: Forget and Rejoin the Wi-Fi Network

Forgetting the network removes its saved settings, including any custom DNS for it, and forces a fresh connection. You'll need the Wi-Fi password to rejoin, so check it first (it's often on a sticker on the router).

# iOS path:
Settings > Wi-Fi > tap (i) next to network name > Forget This Network > Confirm

# Then reconnect:
Settings > Wi-Fi > select your network > enter password

Fix 4: Update iOS or iPadOS

Go to Settings > General > Software Update and install any update. Unexpected warnings have been reported on iOS 14 and 15 in Apple's developer forums, so stay current before you change anything else.

Fix 5: Check Your Manual DNS Servers

Configure DNS > Manual on its own doesn't encrypt anything: it only changes which server your iPhone asks. But on iOS 16 and later, a server that supports Discovery of Designated Resolvers makes your iPhone upgrade to encrypted DNS automatically. We checked on 26 October 2026: 1.1.1.1, 8.8.8.8 and 9.9.9.9 all advertise DoH and DoT this way (Quad9 also DNS over QUIC).

# iOS DNS configuration path:
Settings > Wi-Fi > tap (i) next to network > Configure DNS

# To clear the warning on this network:
Automatic

# Manual servers that iOS 16+ upgrades to encrypted DNS (DDR):
1.1.1.1   1.0.0.1           # Cloudflare
8.8.8.8   8.8.4.4           # Google
9.9.9.9   149.112.112.112   # Quad9

So a manual public DNS server can cause the warning on a network that blocks encrypted DNS: to clear it, switch Configure DNS back to Automatic. Add public servers by hand only on networks that allow encrypted DNS. The setting is per network.

Fix 6: Reset Network Settings

If none of the above fixes work, resetting network settings clears all saved Wi-Fi networks, VPN configurations, and cellular settings, giving your device a completely clean networking state.

# iOS 15 and later:
Settings > General > Transfer or Reset iPhone > Reset > Reset Network Settings

# iOS 14:
Settings > General > Reset > Reset Network Settings

After the reset, your device restarts. You will need to reconnect to all Wi-Fi networks and re-enter passwords. VPN profiles will also need to be reconfigured.

How to Fix on Mac (macOS)

The same warning can appear in your Mac's Wi-Fi settings, and the same sources turn on encrypted DNS there.

Check Private Relay, Profiles and DNS on Mac

On macOS Ventura and later, go to System Settings > Network > Wi-Fi > Details next to the network: turn off Limit IP address tracking to stop Private Relay on that network, and check the DNS tab for manual servers (remove them to clear the warning, since 1.1.1.1, 8.8.8.8 and 9.9.9.9 upgrade to encrypted DNS through DDR). DNS apps and profiles show up in System Settings → General → Device Management. To set DNS servers from Terminal instead:

# Remove manual DNS servers (back to the network's own):
sudo networksetup -setdnsservers Wi-Fi Empty

# Or set servers for Wi-Fi:
sudo networksetup -setdnsservers Wi-Fi 1.1.1.1 1.0.0.1

# Check what's set:
networksetup -getdnsservers Wi-Fi

Flush DNS Cache on Mac

After changing DNS settings, flush the local DNS cache so your Mac uses them at once. Our guide on how to flush DNS cache covers Windows, Linux and browsers too.

# macOS Ventura / Sonoma / Sequoia and later:
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

# Check that DNS resolution works:
nslookup example.com 1.1.1.1

How to Fix on Your Router

If it's your own network, fixing the router helps every device at once. Start with whatever filters DNS.

Check Router Filters, Then Update Firmware

Parental controls, ad blocking and security features on routers and ISP gateways often work by intercepting DNS, and some block encrypted DNS so devices can't skip the filter. Turn the feature off in the router admin panel (or allow DoH and DoT in it) and check whether the warning goes. Then install any firmware update (menu names vary by model):

• ASUS: Router admin panel (192.168.1.1) > Administration > Firmware Upgrade > Check for update
• TP-Link: tplinkwifi.net > System Tools > Firmware Upgrade (or use the Tether app)
• Netgear: routerlogin.net > Administration > Firmware Update > Check Online
• Linksys: 192.168.1.1 > Connectivity > Router Firmware Update

Change DNS Servers on Your Router

If your ISP's DNS is the filter, pointing the router at a public resolver stops it. The router itself still asks that resolver in plain DNS unless it supports DoT or DoH.

# Typical router DNS configuration:
# 1. Open router admin panel: http://192.168.1.1 or http://192.168.0.1
# 2. Navigate to: WAN Settings > DNS Configuration
# 3. Change from "Get from ISP" to "Manual"
# 4. Enter DNS servers:

Primary DNS:   1.1.1.1     (Cloudflare)
Secondary DNS: 8.8.8.8     (Google)

# Alternative: Quad9 with malware blocking
Primary DNS:   9.9.9.9
Secondary DNS: 149.112.112.112

# 5. Save and reboot router

Devices pick up the new DNS server when they reconnect. If the router hands out the public server's address directly (such as 1.1.1.1) rather than its own (192.168.x.x), iOS 16 and macOS Ventura and later switch to encrypted DNS automatically through DDR.

Best DNS Servers That Support Encryption

These public resolvers support both DoH and DoT, so a DNS app or profile for any of them gives you encrypted DNS when the network allows it.

Cloudflare, Google and Quad9 also advertise their encrypted endpoints through DDR, which iOS 16 and macOS Ventura and later use automatically when one of them is your DNS server. Not sure which is quickest from your connection? The DNS Speed Test times them in your browser. Full setup steps: our Cloudflare DNS servers and Google DNS servers guides.

How to Verify Encrypted DNS Is Working

After applying fixes, verify that your DNS queries are actually being encrypted. Here are methods for each platform.

Verify on iPhone/iPad

Check from the device itself:

• Run DNS Robot's DNS Leak Test in Safari: with encrypted DNS working you'll see your chosen provider's servers, not your ISP's
• If you use Cloudflare, visit 1.1.1.1/help: it shows whether your lookups use DoH, DoT or plain DNS
• Go to Settings > Wi-Fi, tap (i) next to the network: the Privacy Warning is gone once encrypted DNS works there, or once nothing on the device tries it

Verify on Mac

On macOS, you can use Terminal to verify DNS resolution and check if encryption is active.

# Check which DNS servers are active:
scutil --dns | grep nameserver

# Test DNS resolution through Cloudflare DoH:
curl -s -H 'accept: application/dns-json' 'https://1.1.1.1/dns-query?name=dnsrobot.net&type=A' | python3 -m json.tool

# Check if DoH is working via Cloudflare's test page:
open https://1.1.1.1/help

When This Warning Is Normal (and Safe to Ignore)

The encrypted DNS warning is not always a problem that needs fixing. In some situations, the network is intentionally blocking encrypted DNS for valid security reasons.

• Corporate/office networks — Your company's IT team blocks encrypted DNS to monitor for malware and enforce security policies. This is standard practice, and your HTTPS traffic stays encrypted
• School networks — US K-12 schools and libraries that receive E-rate discounts must filter under CIPA (Children's Internet Protection Act), and many filter by DNS; universities filter by their own policy
• Pi-hole or AdGuard Home users — a local DNS-based ad blocker may stop devices from switching to encrypted DNS so it can keep filtering. That's by design
• Hotel, airport and café Wi-Fi — public networks often filter DNS. Here the warning matters most: anyone running the network can see your lookups, so use a VPN on Wi-Fi you don't trust

On managed networks you can carry on: your lookups are visible to the network's owner, but your HTTPS pages stay encrypted. The real risk of unencrypted DNS is on untrusted public networks, where someone could watch or tamper with your lookups.

Frequently Asked Questions