You cannot stop your ISP seeing everything, but you can limit what it sees. Start with the DNS and Private Relay settings that Apple, Google, Microsoft and Cloudflare document. Your provider sees more than most people expect, even on HTTPS. Here are the steps, what still shows, and what a VPN changes. We tested none of them.

What your ISP can still see

Privacy.net says a provider can usually see:

  • The domains you visit. HTTPS hides the pages you open and your searches.
  • The IP addresses you connect to, which it can often match to a site.
  • Your IP address, tied to your account, and when you connect.
  • How much data you send and receive.

Many browsers now encrypt DNS requests by default, Privacy.net says, but your ISP can still see the IP addresses you connect to.

Android: Private DNS

Google's Pixel help page says Private DNS secures only DNS lookups and cannot protect anything else. Google recommends keeping it on. It hides the lookup, not the site: your phone still connects to the site's IP address, and Cloudflare says the TLS handshake normally carries the server name, which its Encrypted Client Hello (ECH) masks only for sites that have ECH enabled.

  1. Open Settings and tap Network & internet.
  2. Tap Private DNS. If you can't find it, search Settings for "Private DNS."
  3. Choose Off, Automatic, or Private DNS provider hostname.
  4. Tap Save.

Cloudflare's Android page says Private DNS applies on all networks, including cellular, from Android 9. Its path is Settings > Network & internet > Advanced > Private DNS, and its hostname is one.one.one.one.

iPhone and Mac: iCloud Private Relay

Apple says Private Relay protects your browsing in Safari. It is part of iCloud+ (you, or someone in your Family Sharing group, needs a subscription) and is not available in every country or region. Your IP address stays visible to your network provider and Apple's first relay, but your DNS records are encrypted, so neither sees the site you request.

To turn it on, Apple's iCloud guide gives these steps:

  • iPhone or iPad: Settings > your name > iCloud, tap Private Relay, then turn it on. Tap IP Address Location to change your location setting.
  • Mac: Apple menu > System Settings, click your name, click iCloud, click Private Relay, then turn it on. Click Options to change your location setting.

To turn it off for one network, Apple's Manage page gives these steps:

  • iPhone, Wi-Fi: Settings > Wi-Fi, tap the More Info button next to the network, then tap Limit IP Address Tracking.
  • iPhone, cellular: Settings > Cellular, select your primary number under SIMs, then tap Limit IP Address Tracking. On iOS 18 or earlier, tap Cellular Data Options first.
  • Mac: System Settings > Network, click the service, click Details, then turn off "Limit IP address tracking."

Apple warns that with Private Relay off, network providers and websites can monitor your Safari activity.

Apple's pages we read document no whole-device DNS setting for iPhone or Mac, so we give no steps for one. Cloudflare's iOS page describes a manual DNS setting for one Wi-Fi network (Settings > Wi-Fi, the i icon, Configure DNS, Manual). It must be repeated for each Wi-Fi network, does not work on cellular, and the page does not say it encrypts DNS.

Windows 11: DNS over HTTPS

Microsoft's page says DNS over HTTPS encrypts DNS messages in transit. For a DNS Server, upstream forwarders stay unencrypted. The page covers the server role, not Windows 11 client steps. As with Android, encrypted DNS does not hide the site itself: the destination IP address still shows, and so does the server name in the TLS handshake unless the site uses ECH, per Cloudflare.

How-To Geek, updated November 25, 2023, gives these client steps:

  1. Open Settings > Network & Internet, click your Wi-Fi or Ethernet connection, then open Hardware Properties.
  2. Next to DNS Server Assignment, click Edit and choose Manual.
  3. Turn on IPv4, then enter a preferred and an alternate DNS server.
  4. Set DNS over HTTPS to On.
  5. Repeat for IPv6, then save. How-To Geek says each server should then show "(Encrypted)."

How-To Geek says Windows 11 only works with a fixed list of free resolvers. Its list, "as of November 2023," is Google (8.8.8.8, 8.8.4.4), Cloudflare (1.1.1.1, 1.0.0.1) and Quad9 (9.9.9.9, 149.112.112.112). Its IPv6 list is Google (2001:4860:4860::8888, 2001:4860:4860::8844), Cloudflare (2606:4700:4700::1111, 2606:4700:4700::1001) and Quad9 (2620:fe::fe, 2620:fe::fe:9). The lists may have changed, and we did not test them.

Chrome and Firefox

Chrome's help page says secure DNS is on by default in automatic mode, and falls back to unencrypted lookups if Chrome has trouble. On desktop, the switch is Settings > Privacy and security > Security > Advanced > Use secure DNS. It is unavailable on managed devices or with parental controls.

Mozilla says it completed a default rollout of DNS over HTTPS to US Firefox desktop users in 2019 and Canadian users in 2021, and that you can opt out or pick a custom provider in Firefox's DNS over HTTPS settings. Both are browser settings; we did not confirm whether they affect other apps.

What a VPN does and does not hide

Privacy.net says a VPN encrypts your traffic before it leaves your device, so your ISP sees a connection to a VPN server, not the content or the final destination. The ISP can usually still see that you use a VPN, your location (it assigns your IP address) and the total data you transfer. A VPN moves visibility rather than removing it: the VPN provider can then see the traffic your ISP no longer can, so you are choosing whom to trust.

What we could not confirm

  • Whether any step works on your device. We tested none of them.
  • Any whole-device DNS setting on iPhone or Mac. Apple's pages we read do not give one.
  • Whether Privacy.net's account of what an ISP and a VPN can see matches a primary source. We found none, so those claims are attributed to it alone.
  • Which Android steps need Android 14. Google says some do but does not name them.
  • Router DNS. No source we read covers it.
  • Whether the How-To Geek resolver list is still current. We found no newer Microsoft page with Windows 11 client steps.
  • Whether the Chrome and Firefox pages match your version. We read them on October 12 and tested nothing.