The DNS you chose isn’t always the DNS an app uses.
Some software resolves names through an encrypted channel of its own instead of the resolver you set up. If that resolver filters sites, blocks trackers or sits inside your VPN, the app has just stepped around it.
What’s actually happening
When you set a DNS server (in Windows, on your router, in a VPN client), apps are supposed to use it to turn names into addresses. That is how a family-safety resolver blocks the sites you listed, how an ad-blocking resolver drops trackers, and how a VPN keeps your lookups inside its tunnel.
Encrypted DNS lets an app ask a resolver of its own choosing directly. DoH carries the lookup inside an ordinary HTTPS connection on port 443, DoT uses TLS on port 853, and DoQ uses QUIC on port 853.
Browsers differ. Mozilla began turning DoH on by default for Firefox users in the United States in 2020, sending their lookups to Cloudflare by default. Chrome works the other way: its secure-DNS mode is “auto-upgrading to the current DNS provider’s DoH server”, so it keeps the provider you already use. Beyond browsers, any program can ship a resolver of its own, and Windows does not tell you when one does.
DoH is a good privacy technology: it hides your lookups from the network between you and the resolver. The catch is narrower. When the app, not you, picks the resolver, a choice you made about DNS stops applying to that app.
Why it matters
- A filtering resolver (a family-safety service, a router-level filter) never sees that app’s lookups, so the sites it blocks are still reachable from that app.
- An ad- or tracker-blocking resolver (one you run yourself, say) loses coverage for that app the same way.
- Your VPN’s DNS server isn’t asked either: the lookup goes to the app’s own provider.
- Ferrite’s own DNS lists (the ad, tracker and malware lists, and the sites you block yourself) only apply to lookups that come through Ferrite’s DNS.
What Ferrite does about it
Ferrite has one feature for this, Bypass prevention, under Protection ▸ DNS ▸ What gets blocked. It blocks. There is no flag-only mode. With it on, Ferrite blocks a program’s new connection when the connection is:
- on port 853, to any address. Encrypted DNS (DoT, DoQ) is what that port is for, so Ferrite does not need a list;
- on port 443 (TCP or UDP) to one of 16 well-known public resolver addresses from Cloudflare, Google, Quad9, OpenDNS and AdGuard;
- on port 443, with a TLS handshake that names one of 15 well-known DoH hostnames (Cloudflare, Google, Quad9, OpenDNS, AdGuard, CleanBrowsing, NextDNS and Mullvad). That check needs Ferrite’s deep capture to read the handshake. Ferrite never decrypts the connection.
Each block appears in Activity as DNS bypass guard (“Blocked: it tried to skip Ferrite’s DNS”) with the program that tried, and the DNS screen counts the attempts it has stopped.
Who gets it, and how to turn it on
It is on every plan, and it starts off: switch it on under Protection ▸ DNS ▸ What gets blocked. On Pro you can also exempt chosen apps (a VPN client, say), and those keep their own DNS.
What this doesn’t do
The limits, plainly:
- It needs Ferrite’s packet capture running. Bypass prevention is decided per connection on that path. If it can’t enforce right now, the screen says “On, but nothing enforces it right now” instead of showing a green tick.
- It only acts on programs Ferrite can name. A connection Windows won’t attribute to a program is never blocked as a bypass. That under-blocks on purpose, so Ferrite never cuts off something it can’t identify, and its own DNS is exempt by construction.
- The lists are curated, not exhaustive. A provider that isn’t on them, reached over an address that isn’t on them with a handshake that names a host that isn’t on them, is not caught.
- Plain DNS on port 53 is not classified. An app sending ordinary, unencrypted lookups to a server of its own is not treated as a bypass.
- It blocks the channel, not the app. What an app does after its encrypted lookup is blocked is up to the app.
See it yourself
Turn it on, then watch Activity and the DNS screen. If an app on your machine does bring its own encrypted DNS, you will see the block, the program that tried, and the count, as a real event rather than a claim.