Incognito Cat

Layered Privacy: DNS, VPNs, and Browsers

Layered Privacy: DNS, VPNs, and Browsers

In a recent privacy chat we kept coming back to the same practical question: on a phone, does it make sense to run a custom DNS and a VPN at the same time? Our May post "Privacy Tool Spotlight: DNS" showed why changing from your carrier’s DNS is usually a good idea. Better options can block malware, ads, and trackers while reducing what your provider sees. A Citizen Lab report called "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware" made the stakes clearer: some ads are no longer just annoying. We ran a few simple tests to see what combinations actually deliver.

What is DNS?

DNS works like the phonebook for the internet. When you type a website name such as google.com or youtube.com, DNS turns that name into a string of numbers (an IP address) that computers use to connect.

Without DNS you would have to remember long numbers for every site. With it, you type a name and get there in a fraction of a second. It happens in the background every time you open a webpage, send an email, or use an app.

The Problems with Default DNS

DNS can fail, and when it does the effects are hard to miss. There have been several big outages in recent years. Even if your device is set to a good DNS service, it often cannot fix problems that start somewhere else.

There is another issue. Your mobile carrier or internet provider can see every DNS request your devices make. Most website traffic is encrypted these days, but DNS requests usually are not. That lets your provider build a picture of the sites you visit, the things you like, and even the kinds of devices you own.

They may not see the exact page you read on Booking.com or Amazon.com, but they know you went there. Over time, the list of sites you visit shows a lot about your habits, hobbies, and interests.

Your devices also make thousands of DNS requests on a normal day. Each device has its own pattern. A streaming box asks for different things than a phone. An Apple device talks to different servers than an Android or Windows device. Smart appliances, laptops, tablets, and game consoles all add more detail.

Internet providers can collect this information and use it to create marketing profiles about you and your household.

Testing Procedure

These are not formal laboratory results. They are the kind of quick checks most people can do at home. We used an iPad Pro with LTE on iPadOS 27.2. We tested the carrier’s DNS, Control D set to its Family configuration, Proton VPN Free (NetShield not available), Proton VPN Paid with NetShield (its built-in ad and tracker blocker) enabled, and Nym VPN with ad blocking enabled. We also tested on our lab Wi-Fi with DNS blocking turned on. The browsers were Safari (the default) and Brave (which includes its own ad and tracker blocking), both in private mode so nothing was cached.

Every test used the same ad-blocking test site: https://superadblocktest.com/. We did one pass for each setup. We turned on the DNS or VPN, opened the browser, went to a private tab, ran the test, wrote down the score, and closed the browser. These are not repeated trials under strict conditions. They are simple checks meant to show the general pattern.

The Results

Higher percentages mean more ads and trackers were blocked on the test page. These are single-pass checks on one device, so treat them as directional rather than lab-grade. The gap between Safari and an ad-blocking browser like Brave stood out right away. Adding a better DNS service or a VPN that handles DNS improved the scores further. For most people we talk to, Control D is the simplest free way to start blocking content. Even Proton’s free VPN gave Safari a clear boost. Network-level filtering (the Wi-Fi test) still benefits heavily from a blocking browser.

What Does This Mean?

One change can help, but the right mix of tools usually works better. For most people, switching to an ad-blocking browser like Brave plus a free filtering DNS such as Control D (Family) already delivers strong results with almost no setup. Adding a VPN that includes its own filtering (Proton Paid with NetShield or Nym with ad blocking) can push the numbers higher, especially on mobile where the carrier DNS is otherwise fully visible.

When you try a new DNS, VPN, or browser setting, check that it actually improves the results you care about. Don't rely on "Trust me, bro." Also check that it has not accidentally made things worse. A one-minute test on your own device is the only reliable way to confirm the combination is actually working for you.

Remember: We may not have anything to hide, but everything to protect.

Layered Privacy: DNS, VPNs, and Browsers

#DNS #DigitalPrivacy #Privacy