---
metadata:
  - name: generator
    content: Diplodoc Platform v5.54.4
alternate:
  - https://yandex.ru/support/browser/en/security/dnscrypt.md
  - https://yandex.ru/support/browser/kk/security/dnscrypt.md
  - https://yandex.ru/support/browser/ru/security/dnscrypt.md
  - https://yandex.ru/support/browser/tr/security/dnscrypt.md
  - https://yandex.ru/support/browser/uz/security/dnscrypt.md
  - href: en/security/dnscrypt.md
    type: text/markdown
    title: Markdown version
  - href: ../llms.txt
    type: text/markdown
    title: llms.txt
keywords:
  - DoH.
  - DNS encryption.
---
> **Documentation Index:** Fetch the complete configuration index at https://yandex.ru/support/browser/en/llms.txt




# Protect: secure DNS requests

[Yandex Browser](https://browser.yandex.com/) features an integrated security system called [Protect](https://yandex.ru/support/browser/en/security/protection.md), which uses the [DNS over HTTPS (DоH)](https://en.wikipedia.org/wiki/DNS_over_HTTP) technology to safeguard users against interception, data manipulation, and subversion of DNS requests.


{% note info %}

By default, DoH encryption is disabled, but you can [enable](#off) it.

{% endnote %}


## DNS hijacking risks {#danger}

To access an internet site, you need to know its [IP address](https://en.wikipedia.org/wiki/IP_address). It's easier for users to remember domain names (the letters comprising the site address) than the string of numbers that make up the IP address. _DNS_ is a distributed system for getting the IP addresses that correspond to domain names.
When a user enters a website address in Yandex Browser without using encryption, the following occurs:

1. The browser sends a request specifying the domain to a special [DNS server](https://en.wikipedia.org/wiki/Name_server).
1. The DNS server returns a response with the appropriate physical IP address.


{% note alert %}

The DNS server request and response are transmitted openly, without encryption.

{% endnote %}


The lack of encryption means that:

- The internet provider or network administrator can find out which sites a user is visiting.
- Attackers can tamper with the response from the DNS server and redirect the user to a malicious site. For example, instead of going to a bank's website, a user might end up on a fake site that steals passwords.

![](../_image/dnscrypt-1.svg) --><!--Generator: Adobe Illustrator 24.0.2, SVG Export Plug-In . SVG Version: 6.00 Build 0)


## DoH technology in Yandex Browser {#what}

DoH uses encryption to protect users from DNS hijacking and spoofing. When you enter a website address in Yandex Browser with encryption enabled:

1. DoH encrypts the DNS request from your computer using the [TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security) protocol.

1. The encrypted request is sent to DNS servers with DoH support as HTTPS GET and POST requests.

1. The DNS server then sends the encrypted IP address to your computer over the HTTP or HTTP/2 protocol.

As a result of encrypting the sessions between your Yandex Browser and the DNS server:

- Network administrators and ISPs can't track your DNS requests and find out what websites you visit.

- Attackers can't change the DNS server's response and redirect your Yandex Browser to a fraudulent website.

![](../_image/dnscrypt-2.svg) --><!--Generator: Adobe Illustrator 24.0.2, SVG Export Plug-In . SVG Version: 6.00 Build 0)

## Enable encryption of DNS requests {#off}

1. In the upper-right corner, click **![](../_image/settings-icon.svg)**&nbsp;→ **Settings**.


1. Go to the **Security** tab at the top of the page.

1. In the **Secure connection** section, enable **Use a secure DNS server**.

1. Select a service provider from the drop-down list, if necessary. By default, the setting is set to **Use the current service provider**.



<a href="en/support/support">
<span class="button">Contact support</span>
</a>


<!-- source: en/_includes/black-button-styles.md -->



<!-- endsource: en/_includes/black-button-styles.md -->