Sovatun Guide

Encrypted DNS vs VPN on iPhone: What Each One Actually Protects

Encrypted DNS and VPN both "encrypt" your iPhone traffic—but at different layers. Learn what each actually protects, what stays visible on public Wi-Fi, and how to choose.

• 8 min read • Updated

Answer First

Definition: Encrypted DNS and a VPN are both forms of network encryption on your iPhone, but they operate at different layers. Encrypted DNS — the DNS over HTTPS (DoH) or DNS over TLS (DoT) option you can configure on iOS through a DNS profile, and the version built into third-party DNS apps — encrypts only the domain-name lookup: the moment your phone asks “what is the IP address of example.com?” A VPN encrypts the entire connection between your device and the VPN server, routing all of your internet traffic through it.

Why: Both features are marketed as “encryption,” so it is easy to assume they protect the same things. They do not. Encrypted DNS hides one step of one request from the network. Once the lookup is answered, the rest of your traffic behaves as it did before: the network still sees the sites and services you connect to, when you connect, and any traffic that HTTPS does not already encrypt. Turning on encrypted DNS on public Wi-Fi does not make you VPN-protected for the rest of your traffic — the two protections cover different layers, and only one covers the connection.

Example: You are on airport Wi-Fi. With encrypted DNS active, someone snooping on the network can no longer read your plaintext query for “mybank.com”; they see only an encrypted exchange with your DNS resolver. But they can still see your iPhone connecting to mybank.com’s server, and any app that sends data without HTTPS stays visible in the clear. With a VPN, the network sees a single encrypted tunnel to the VPN server and nothing else: no lookup, no destination, no app traffic.

Key Facts

  • Encrypted DNS protects exactly one step — the lookup that turns a domain name into an IP address — and nothing after it: the network still sees the sites and servers you connect to, connection timing, and traffic HTTPS does not cover.
  • A VPN protects the whole path: DNS queries and app traffic travel inside one encrypted tunnel from your iPhone to the VPN server.
  • HTTPS already encrypts the content of most website traffic, so what remains exposed is the lookup, the destination, and non-HTTPS traffic.
  • Neither tool prevents phishing, malware, account compromise, or all tracking. Encryption changes who reads your traffic; it does not judge what you click.
  • Trust is moved, not removed: whoever runs your resolver (encrypted DNS) or VPN server (VPN) is positioned to see the corresponding traffic.

Expert Explanation

DNS is the phonebook step

Before your iPhone can load a website or talk to an app’s server, it must translate a name like www.example.com into a numeric IP address. That lookup is DNS, and it happens on nearly every connection. By default, these queries are sent in plaintext, so anyone on the same network — or the internet provider between you and the resolver — can read which domains you are asking about and can interfere with the answers.

Encrypted DNS fixes exactly that message: DNS over HTTPS, standardized in RFC 8484, sends queries and responses inside HTTPS, so on-path devices cannot read or tamper with the lookup. On iPhone you typically enable this with a DNS configuration profile or a third-party DNS app that offers DoH or DoT.

What is still visible with encrypted DNS

The lookup is only the first step. Once the IP address comes back, your iPhone connects directly to that server, and the encrypted-DNS protection is over — it applied to the query, not to what follows. The network now sees the destination, the timing, and the traffic itself. For websites, HTTPS hides page content, but the network still sees which site you are talking to and when. For apps that do not use HTTPS, the payload is visible in plaintext to anyone on the network.

Note the trust shift: the resolver now sees your lookups, so the ability to observe them moves from the network to the resolver’s operator. Privacy is relocated, not eliminated.

What a VPN adds on top

A VPN wraps the whole connection. It creates an encrypted tunnel from your iPhone to a VPN server and pushes all of your IP traffic — DNS queries included — through it. Apple’s platform security documentation details the protocols iOS uses — IKEv2/IPsec and SSL-VPN apps — plus options like VPN On Demand. This matters most on public Wi-Fi, where CISA’s guidance warns about evil-twin access points that impersonate real hotspots and the sniffing of unencrypted traffic. From the network’s perspective, a VPN presents one encrypted connection to the VPN server: no readable lookups, no visible destinations, no visible app traffic.

Because DNS travels inside the tunnel, an encrypted-DNS profile has little left to do while the VPN is active — the VPN’s own DNS configuration typically takes over. The two are not additive; the VPN covers the DNS step as part of the whole.

Where each one stops protecting

The useful question is where encryption ends: at the resolver, or at the VPN server. Past that point, normal internet rules apply: the sites you visit still see your traffic (from the VPN’s exit IP), and the party operating the tunnel — your VPN provider — is positioned to see everything flowing through it. The same applies to a DNS operator, over a smaller slice of data. “VPN app” is also a label some data collectors have abused: the Facebook Onavo case showed a VPN app quietly gathering user data, and Apple has removed VPN apps from the App Store over data-collection behavior. On iPhone, a VPN asks for local network access permissions, so it pays to understand what a VPN can reach on your device.

None of this makes a VPN a security shield. It will not stop a phishing page that looks like your bank’s login — the page is still fake through an encrypted tunnel — and it will not remove malware or stop someone who already has your password. It protects connection privacy, and that is the job it does well.

Comparison table

What to compareEncrypted DNS (DoH/DoT)VPN
What it encryptsThe domain-name lookup onlyAll traffic from your iPhone to the VPN server
What the network still seesDestination sites, connection timing, non-HTTPS trafficOne encrypted tunnel to the VPN server
Where encryption endsAt the DNS resolverAt the VPN server
Who is positioned to see your dataThe resolver operator (your lookups)The VPN provider (your traffic)
Best forStopping DNS snooping and tampering on the networkConnection privacy on public Wi-Fi and untrusted networks

Decision Framework

Use this checklist to decide what your iPhone actually needs.

Choose encrypted DNS when:

  • You want to stop the network or your ISP from reading and tampering with your domain lookups.
  • Your traffic is mostly HTTPS, and you are comfortable with the resolver operator seeing your queries.
  • You do not need to hide destinations or protect non-HTTPS app traffic.

Choose a VPN when:

  • You are on public Wi-Fi — airport, hotel, café — and want the connection itself protected, not just the lookup.
  • You want the network to see one encrypted tunnel instead of your destinations and app traffic.
  • You need protection for apps that do not use HTTPS.
  • You accept that the VPN provider sees your traffic and choose the provider accordingly.

Whichever you pick, treat “encryption” as a layer, not a shield — and keep the basics on: HTTPS where available, strong passwords, two-factor authentication, and skepticism toward unexpected login pages. SovaTun is an iPhone-focused VPN built for everyday connection privacy and public-Wi-Fi use.

Key Takeaways

  • Encrypted DNS and a VPN both encrypt, but at different layers: the lookup versus the whole connection.
  • On public Wi-Fi, encrypted DNS alone does not protect the rest of your traffic; the network still sees where you connect and what non-HTTPS apps send.
  • A VPN carries DNS lookups and app traffic inside one tunnel, but protection ends at the VPN server, and the provider can see what passes through.
  • Neither tool prevents phishing, malware, or account takeover — encryption is a layer, not a shield.
  • Choose by what is exposed: lookups and tampering point to encrypted DNS; connection privacy on untrusted networks points to a VPN.

FAQ

Q: Is encrypted DNS on iPhone the same as a VPN?

A: No. Encrypted DNS (DoH/DoT) encrypts only the domain-name lookup between your iPhone and a DNS resolver. A VPN encrypts the whole connection to a VPN server, carrying all traffic — DNS included — through one tunnel.

Q: If I turn on encrypted DNS on public Wi-Fi, is my traffic protected?

A: Only the lookup step. The network still sees which servers you connect to and when, and non-HTTPS app traffic stays visible. To protect the connection itself on public Wi-Fi, you need a VPN — encrypted DNS does not stand in for one.

Q: Does a VPN protect me from phishing and malware?

A: No. A VPN encrypts the route your traffic takes; it does not judge whether a page is fraudulent or a download is malicious. A fake login page is still fake through a VPN, which is why phishing awareness, strong passwords, and two-factor authentication matter regardless.

Q: Can I use encrypted DNS and a VPN at the same time?

A: You can, but while the VPN is active it normally carries DNS inside its tunnel, so a separate encrypted-DNS profile has little left to do — the VPN’s DNS settings take precedence. When the VPN is off, the profile still protects lookups.

Sources