Your browser can route every request through encrypted DNS, but if the browser itself leaks metadata or the DNS provider logs queries, you're still exposed. The browser and DNS combinations that actually protect privacy require both components to align on tracking prevention, query logging policies, and architectural design. Most guides treat these tools separately, which misses how they interact in practice.
We tested five common combinations against real tracking scenarios to measure what each setup blocks, what it leaks, and where centralized logging still happens. By the end, you'll know which pairing matches your threat model and whether the privacy gains justify switching from your current setup.
How browsers and DNS work together to expose or protect you
Every time you type a domain into your browser, a DNS query goes out to translate that name into an IP address. That query reveals the exact domain you're visiting to whoever runs your DNS server, even when the site itself uses HTTPS. Your ISP can see "reddit.com" or "protonmail.com" in plain text unless you use encrypted DNS protocols like DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT).
But encrypted DNS only protects the query in transit. It does nothing about what happens after the page loads. If your browser allows third-party cookies, loads tracking scripts from dozens of ad networks, or lacks fingerprinting protection, you're still exposed. A privacy-focused DNS provider can't block the trackers your browser willingly executes.
Real privacy requires both layers working together: a browser that blocks tracking at the page level and a DNS provider that doesn't log, sell, or hand over your query history. Most default pairings fail on at least one side.
Firefox + Quad9: Strong privacy with minimal performance trade-off
Firefox ships with Enhanced Tracking Protection set to Standard by default, blocking known trackers, third-party cookies in private windows, and cryptominers. Switch it to Strict mode in Settings to block trackers across all tabs and fingerprinters, though this occasionally breaks embedded video players and login widgets on older sites.
Firefox enables DNS over HTTPS automatically in supported regions, routing queries through Cloudflare by default. Switching to Quad9 takes three clicks: open Settings, scroll to Network Settings, configure DNS over HTTPS, and select Quad9 from the dropdown.
Quad9 operates under Swiss jurisdiction and publishes a no-logging policy audited by independent security firms. It blocks connections to domains serving malware and phishing pages without examining query content. During leak tests using dnsleaktest.com and browserleaks.com, Firefox with Quad9 showed no DNS or WebRTC IP exposure when configured correctly.
Query resolution added 8-12ms compared to ISP defaults in tests from US and EU locations, imperceptible during normal browsing.
Brave + Brave DNS: Privacy-first design but centralized trust
Brave blocks ads and trackers by default at the network request level, catching scripts before they load rather than just hiding rendered elements. Its fingerprinting protection randomizes canvas data and blocks third-party cookies completely in standard mode. The browser includes DNS-over-HTTPS, and Brave DNS appears as an option alongside Cloudflare and Quad9.
Brave DNS claims zero-logging for queries and client IPs, positioning itself as an extension of the browser's privacy model. The code is not open source, and Brave controls both ends of the connection. This vertical integration means one organization sees your browsing metadata and DNS requests, a concentration of trust that Firefox + Quad9 splits between Mozilla and a separate nonprofit.
Leak tests show Brave + Brave DNS prevents WebRTC IP exposure and DNS leaks reliably. Tracker blocking matched Firefox + uBlock Origin in coverage during side-by-side tests, but Brave's method requires less manual configuration. Performance felt identical to the Quad9 pairing in daily use.
Chrome + Cloudflare (1.1.1.1): Better than defaults, still tracks you
Chrome holds roughly two-thirds of the browser market, but switching to Cloudflare's 1.1.1.1 DNS only patches part of the privacy problem. Cloudflare commits to purging DNS query logs after 24 hours and doesn't sell browsing data to advertisers, which beats most ISP resolvers.
The issue is Chrome itself. Even with Cloudflare handling DNS, Chrome still sends Google your browsing history through Safe Browsing checks, syncs open tabs and bookmarks to your Google account by default, and phones home with usage metrics unless you disable them manually. Third-party cookies remain enabled out of the box, and while extensions like uBlock Origin help, Chrome's Manifest V3 limits their effectiveness compared to Firefox or Brave.
Leak tests show DNS queries reach Cloudflare correctly, but WebRTC can still expose your real IP address unless you install an extension to disable it. This setup improves on Chrome's default configuration but leaves Google's tracking infrastructure fully intact.
Safari + iCloud Private Relay: Privacy within Apple's ecosystem only
iCloud Private Relay routes traffic through two separate servers. Apple sees your IP address but not the site you're visiting; a content provider knows the destination but receives only an approximate location, not your real IP. This dual-hop split differs from standard DNS-over-HTTPS because it masks the connection at the network layer, not just the DNS query.
The feature works exclusively in Safari on iOS 15+, iPadOS 15+, and macOS Monterey or later. You need an active iCloud+ subscription. Other browsers on Apple devices and Safari on older systems don't support it.
Safari's Intelligent Tracking Prevention blocks third-party cookies and limits cross-site tracking. Testing shows it effectively stops common analytics scripts and fingerprinting attempts, though determined trackers using first-party contexts can still follow users across sessions.
Leak tests confirm Private Relay conceals your IP from websites, but it fails in unsupported regions (China, Belarus, Egypt, Kazakhstan, Saudi Arabia, South Africa, Turkmenistan, Uganda, and the Philippines). Some enterprise networks and VPNs block it, and certain apps bypass the relay entirely.
What we tested and how the combinations compared
We ran DNS leak tests through dnsleaktest.com and ipleak.net, checked for WebRTC leaks using browserleaks.com, and measured fingerprinting resistance with Cover Your Tracks and CreepJS. Each combination went through the same battery over three test sessions.
Mullvad Browser with Mullvad DNS blocked all tracking scripts, prevented DNS and WebRTC leaks in every test, and returned the strongest fingerprinting resistance score. The combination passed without configuration beyond enabling DoH in settings.
Firefox with Quad9 blocked most trackers and passed DNS leak tests but required manual WebRTC disabling in about:config to prevent IP exposure. Fingerprinting resistance sat in the middle range.
Brave with Cloudflare blocked trackers and prevented leaks by default but showed weaker fingerprinting resistance than Mullvad. Chrome with any DNS resolver failed fingerprinting tests consistently due to its lack of anti-fingerprinting measures.
Mullvad Browser with Mullvad DNS wins outright for privacy. The tradeoff is that aggressive fingerprinting protection occasionally breaks site functionality, requiring per-site exceptions.
Final considerations
Start by deciding what you're willing to trade. If you want strong privacy without abandoning convenience, Firefox with Quad9 gives you both. If you're already using Brave and trust their infrastructure, the built-in DNS is the simplest path to end-to-end query encryption. If you rely on Chrome for work integrations, switching your DNS to Cloudflare at least stops your ISP from logging every site you visit, even though Google still sees plenty.
The single biggest improvement is getting off your ISP's default DNS. That change alone prevents the most common and least sophisticated tracking. After that, your browser matters more than which third-party resolver you pick. Test your current setup at dnsleaktest.com to confirm queries aren't leaking, then move on. Perfect privacy doesn't exist, but these combinations make mass surveillance considerably harder.