You changed the DNS in Windows, flushed the cache, even edited the router — and Chrome still fails the same sites. The browser was never using your settings. Its own private DNS channel was answering all along.
Modern browsers ship with DNS over HTTPS, often labelled Use secure DNS. Instead of asking the DNS server your system is configured with, the browser sends name lookups inside encrypted HTTPS traffic to a provider it chooses. There are genuine privacy reasons for this. But it draws a curtain between your fixes and your browser: every Windows and router DNS change in this series can be perfectly correct, and the browser will not notice, because it was never listening. This page shows how to recognise the symptom, where the switch lives in Chrome, Edge and Firefox, and when turning it off for a test is the honest diagnostic move.
Use secure DNS [ ON ]
With: Cloudflare (1.1.1.1)
While this is on, the browser resolves names itself — Windows and router DNS settings do not apply to it.
Normally, name resolution is a system service: every program asks Windows, Windows asks the configured DNS server, and one setting rules them all. With secure DNS on, the browser keeps its own resolver. Its lookups travel encrypted to a provider such as Cloudflare or Google, indistinguishable from ordinary web traffic.
Two consequences follow. The good one: your ISP or local network cannot easily watch or tamper with the browser's lookups. The confusing one: system DNS settings stop applying to the browser at all — the fact this page exists to save you from.
Suspect this setting whenever the failure respects browser boundaries. Classic shapes: sites fail in Chrome but open in Firefox or in apps; or the reverse — after you fix DNS in Windows, every app recovers except the browser you fixed it for. Another tell: you change DNS on the router, the whole house heals, and one browser on one PC keeps failing the same names.
Before changing anything else, run one comparison: the same failing site, in the suspect browser and in any other program. A split result here is worth more than another hour of Windows settings.
In Chrome: Settings → Privacy and security → Security → scroll to Use secure DNS. In Edge: Settings → Privacy, search and services → Security → Use secure DNS. In Firefox: Settings → Privacy and Security → scroll to DNS over HTTPS, which offers levels from Default to Off.
Each offers the same essential choices: use a named provider, use the current service provider (meaning your system DNS, upgraded to encrypted form when possible), or turn the feature off. For pure troubleshooting, Off or current provider are the test positions — both put the browser back under system DNS, where your other fixes apply.
On office machines there is an extra wrinkle: secure DNS can bypass the company's DNS-based filtering and internal names, which is why many workplaces disable it by policy. If your browser's setting is greyed out and says it is managed, that is deliberate — leave it alone and talk to IT.
Secure DNS is not a villain. On untrusted networks it protects your lookups from snooping and tampering, and for many home users it quietly upgrades an ISP resolver they never chose. Its cost appears only when something breaks: one more private channel to remember while diagnosing.
The practical rule: keep it if you value it, but the moment a browser-only failure appears, put this setting on your suspect list — second only to the proxy check. Knowing it exists is 90 percent of the fix.
See every step on a real Windows PC — the tests, the commands and the DNS change, in order.
▶️ Watch Full VideoNo. It is a privacy feature with real value, especially on public or untrusted networks. Turn it off when you are diagnosing a browser-only failure, or when it conflicts with a network you depend on — an office domain, for example. Treat it as a setting to understand, not a defect to remove.
It tells the browser to use the same DNS server your system is configured with — your router or ISP resolver — but to speak to it over an encrypted channel if that server supports one. It keeps one source of truth for settings while still encrypting the lookups where possible.
Very often, yes. Router-level blocking and filtering work by controlling DNS answers. A browser resolving names through its own encrypted channel never asks the router, so the rules are silently bypassed — the same reason this setting hides faults also makes it slip past filters.