VPN vs DNS: who can still see what

Search “VPN vs DNS” and the results stitch together three different tools as if they were one choice. Plain DNS just turns a domain name into an address, nothing more. Encrypted DNS (DNS over HTTPS or DNS over TLS) hides that lookup from anyone watching the connection, but it does not touch anything else the device sends. Smart DNS reroutes selected lookups to unblock streaming libraries, with no encryption and no IP change. A VPN sits in a different category entirely: it encrypts the whole connection and swaps the visible IP address for its own — the tunnel mechanics behind that are in our guide to what a VPN is.

Those four setups leak in four different shapes, and the difference is easiest to see when you stop asking which one is “safer” and start asking who is still watching. VPN prices below are the ones the providers in our full VPN rankings published on 23 Jul 2026.

What can each option actually see?

The real difference is not which one “protects” you in the abstract — it’s who still gets to see what once each one is running. Here is the same connection run through all four setups, party by party.

Who can see what: plain DNS, encrypted DNS, Smart DNS, and a VPN

Who is looking	Plain DNS	Encrypted DNS	Smart DNS	VPN
Your ISP	Sees every domain you look up, plus your traffic in the clear	Can't read your lookups; still sees your traffic and its destination	Sees your lookups and traffic — nothing here is encrypted	Sees that you are connected to a VPN server, not the lookups or the traffic inside it
Local network (café, hotel, office Wi-Fi)	Visible to whoever runs the network, same as any other device on it	Can't read your lookups either	Sees your lookups and unencrypted traffic	Sees one encrypted stream to a single server, nothing readable inside
The DNS resolver you use	Usually your ISP's own resolver, which logs the lookup under its own policy	Whichever resolver you picked — Cloudflare, Quad9, or similar — under its own policy	The Smart DNS provider, for whichever services it's rerouting	The VPN provider's own resolver, if the app routes DNS through the tunnel
Your VPN provider	Not in the path	Not in the path	Not in the path	Sees your traffic pass through its servers, and usually your DNS lookups too
The site you visit	Your real IP address	Your real IP address — encrypting the lookup doesn't change who connects	A proxy IP for the services it's rerouting; your real IP everywhere else	The VPN server's IP address, never yours

The pattern: encrypted DNS closes one gap — your ISP reading your domain lookups — and leaves the rest of the row open. Smart DNS closes no privacy gap at all; it exists to reroute, not to hide. Only a VPN closes every row here at once, and even that has a catch, covered below.

What does plain DNS do?

Plain DNS is the default nobody configures. Type a domain name and DNS translates it into an IP address your device can connect to. Private Internet Access describes the job plainly: it “translates human-friendly website names…into computer-friendly IP addresses,” something the internet needs to function at all. Nothing about that lookup is private. It goes out unencrypted, in plain text, to whatever resolver your ISP or router assigns automatically, and anyone in a position to see that traffic sees exactly which domains you’re asking about. Pointing your device at a different public resolver, such as Cloudflare’s 1.1.1.1, changes who receives that list. It does nothing to encrypt the request, and it doesn’t stop the new resolver — or anyone on the path to it — from reading the same lookups in the clear.

What does encrypted DNS protect?

Encrypted DNS wraps that same lookup in DNS over HTTPS or DNS over TLS so nobody watching the connection, your ISP included, can read which domains you’re asking about. Cloudflare’s own documentation for its 1.1.1.1 resolver explains that DoH sends the encrypted query over the same HTTPS port used for ordinary web traffic. That makes it “difficult to distinguish from other HTTPS traffic on the network,” rather than a separate stream someone can flag and block. That is a real, narrow win — your ISP loses the plain-text list of domains it used to see by default.

It’s also exactly where the gap opens. Tailscale’s technical comparison of the two categories draws the line cleanly: a VPN encrypts all internet traffic, while encrypted DNS secures “DNS queries only.” It “does not encrypt broader internet traffic or hide IP addresses.” Once the name resolves, your device still connects to the site directly, and the site still sees your real IP address. Encrypted DNS protects one specific request type — it was never built to protect the connection that follows it.

What does Smart DNS unblock?

Smart DNS solves a different problem: a smart TV, games console, or router that can’t install a VPN app but still needs a streaming library outside its own region. NordVPN’s own support documentation is blunt about the trade-off: “SmartDNS does not protect your devices the way a VPN connection does — it simply provides access to streaming content.” Windscribe’s comparison of the two categories agrees. Smart DNS “doesn’t encrypt any of your traffic.” It also “doesn’t mask your IP, so it stays visible to every website.”

What it does do is reroute the DNS lookups for a specific list of streaming services through Smart DNS servers in the region you want, so those services see a connection that looks local. Private Internet Access frames the mechanics the same way: Smart DNS “routes only certain parts of your internet traffic…through proxy servers in different regions,” with “no encryption — traffic is not protected.” Every other kind of traffic on the device, and every site outside that specific list, keeps showing your real IP.

That’s also why Smart DNS runs on hardware a VPN app can’t reach. It needs only a DNS setting, not installed software, which is why it works on “Smart TVs, consoles, routers,” per Windscribe’s own comparison. If the device itself is the real blocker, a VPN router solves the same problem differently, by putting the whole tunnel at the network level instead of routing around the gap.

Does a VPN already handle your DNS?

Yes, by default. Proton VPN’s own explainer is direct about it: “When using a VPN, DNS requests are routed through the VPN tunnel and resolved by the VPN service. As the VPN tunnel is encrypted, the DNS requests are encrypted without the need for a private DNS protocol.” A working VPN already delivers what encrypted DNS is trying to provide, plus everything else. The lookup and the traffic that follows it travel through the same tunnel, and the site you visit sees the VPN server’s IP address rather than a proxy address or your own.

Does adding private DNS to a VPN help or hurt?

It usually hurts. Proton VPN’s blog states the risk directly: “not only is private DNS not needed when using a VPN” — because the tunnel already encrypts the lookup — “it can cause a DNS leak.” The mechanism is specific: turning on a third-party DNS service on the device “makes it more likely DNS requests will be routed outside the VPN tunnel.” An already-encrypted third-party lookup is simply harder for the VPN app’s own DNS-protection logic to catch and keep inside the tunnel. The safer default is to leave DNS on whatever the VPN app sets automatically, and skip the private-DNS toggle in your device settings while it’s connected.

Can you run Smart DNS and a VPN at once?

Not usefully, on the same device. Windscribe’s comparison says it plainly: “If you try to run both on the same device at the same time, the VPN’s encrypted tunnel will typically take priority and override your manual DNS settings.” The Smart DNS routing you configured stops doing anything the moment the VPN connects. Most people solve this by running the two on different devices — Smart DNS on the TV or console that can’t take a VPN app, and the VPN app itself everywhere that can run one.

A few providers sidestep the conflict by folding the DNS side into the VPN product itself. NordVPN’s support documentation describes its SmartDNS as part of SmartPlay, its own streaming feature, rather than a separate service you point a device at — so there is no hand-configured DNS setting left to lose the fight with the tunnel.

What does each option cost?

Plain and encrypted DNS cost nothing at the basic level. Smart DNS and a VPN are where money changes hands, and the numbers aren’t close.

What each setup typically costs

Setup	Typical monthly cost	Example
Plain DNS	Free	Whatever resolver your ISP or router assigns automatically
Encrypted DNS	Free for a public resolver; paid tiers add features	Windscribe's 2026 comparison lists Control D at $3/mo for ad and tracker blocking, $6/mo with 400+ services of geo-unblocking added
Smart DNS	About $2 to $5/mo standalone	Windscribe's 2026 comparison
VPN	About $2 to $15/mo, no flat rule	As of 23 Jul 2026: Mullvad charges a flat €5/mo including VAT and has since 2009, about $5.71 at that day's conversion; NordVPN's 2-year rate is $3.49/mo, renewing near $11.59/mo; CyberGhost's intro rate is $2.19/mo, renewing near $4.75/mo

Full pricing and renewal terms for every provider we track are in our cheap VPN picks, sorted by what you actually pay after the intro period ends.

Choose plain DNS if

• You aren’t trying to hide anything from your ISP or network — you just want a resolver that works.
• You already run a VPN or encrypted DNS elsewhere that handles the lookups instead.
• You want the simplest setup possible, with nothing to configure and nothing to pay for.

Choose encrypted DNS if

• You want your ISP out of your domain-lookup history without touching your IP address or the rest of your traffic.
• You’re not running a VPN and don’t plan to, but still want to close the one gap DoH or DoT actually closes.
• You want it set once, at the device or router level, instead of configured separately in every app.

Choose Smart DNS if

• The device is a smart TV, console, or streaming box that can’t install a VPN app.
• You only care about reaching one specific streaming library, not general privacy.
• You’re fine with your real IP address staying visible everywhere Smart DNS isn’t specifically rerouting.

Choose a VPN if

• You want your traffic encrypted, not just your DNS lookups.
• You’re on a network you don’t control — public Wi-Fi is the clearest case — and want everything protected, not just the domain names.
• You want your real IP address hidden from every site you visit, not only the ones on a Smart DNS list.

Frequently asked questions

What is the difference between a VPN and DNS?

DNS turns a domain name into an IP address, nothing more. A VPN encrypts the whole connection and replaces the visible IP address with its own server's. They sit at different layers and solve different problems.

Does a VPN use DNS?

Yes. Every domain lookup still has to happen — a VPN just moves where it happens, routing the request through its own encrypted tunnel and resolving it with its own servers instead of your ISP's.

Can DNS replace a VPN?

No, in any of its three forms. Plain DNS carries no privacy protection, encrypted DNS only protects the lookup, and Smart DNS adds no encryption either — none of the three hides your IP address or encrypts the traffic that follows the lookup.

Does a VPN hide DNS requests from your ISP?

Yes, as long as the VPN app is handling DNS itself, which is the default. Proton VPN's own explainer confirms the tunnel encrypts DNS requests along with everything else, so a separate encrypted-DNS setup adds nothing on top of it.

Should you use private DNS alongside a VPN?

Generally no. Proton VPN's blog states that private DNS is not needed once a VPN is running and that turning it on can cause a DNS leak, by making it harder for the VPN app to keep third-party DNS requests inside its own tunnel.

Does Smart DNS work at the same time as a VPN?

Not usefully, on one device. Windscribe's own comparison says a VPN's encrypted tunnel typically overrides manual DNS settings when both run together, so the Smart DNS routing stops doing anything the moment the VPN connects.

Which is better for streaming, Smart DNS or a VPN?

It depends on the device. Smart DNS needs no app and runs on hardware a VPN can't reach, like many smart TVs, but it adds no encryption and leaves your IP visible outside the services it reroutes. A VPN app, where the device supports one, covers both the unblocking and the privacy.

Is encrypted DNS the same thing as a VPN?

No. Encrypted DNS, whether DNS over HTTPS or DNS over TLS, only protects the domain-lookup step. A VPN encrypts every packet the device sends and swaps the visible IP address — a broader job encrypted DNS was never built to do.

Is DNS faster than a VPN?

A DNS change can only affect how quickly names resolve, not the underlying connection speed. A VPN can add some delay, since it encrypts traffic and routes it through another server first — how much depends on the server distance and protocol, not a fixed number either tool can promise.