What can go wrong on public Wi-Fi
Public Wi-Fi is safer than it used to be. Most websites and apps now encrypt their traffic, so other people on the network can't read your passwords or emails. But a few problems remain, and most of them involve DNS:
- You use their DNS. When a laptop joins a network, it usually accepts whatever DNS server that network hands out. You don't know who runs it, what it logs, or whether its answers are honest. Ordinary DNS is also unencrypted, so anyone on the same network can see which sites you look up.
- No filtering at all. At the office, your DNS filter blocks phishing, malware and command-and-control domains. On the café's DNS, none of that happens. A phishing link that would be blocked at your desk opens normally at the airport.
- Look-alike hotspots. Anyone can name a hotspot "Hotel Guest" or "Airport Free Wi-Fi". If a device joins the wrong one, the person running it controls the DNS answers.
- Captive portals. Hotel and airport sign-in pages intercept traffic until you accept the terms. They can also get in the way of encrypted DNS and VPNs until you've signed in.
Network-level filtering, set on your router or firewall, can't help here: the laptop isn't behind your router. Protection has to travel with the device.
Option 1: encrypted DNS on each device
DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) send DNS lookups encrypted to a server you choose, instead of to the local network's DNS. If that server is your filtering provider, the device keeps your policy on any network: home, hotel, café or mobile data.
The key detail is a per-device address. At the office, a filter recognises your network by its public IP. On hotel Wi-Fi the IP is the hotel's, so the device needs its own address that tells the filter which policy to apply. Most providers, DNSAFE included, give each device a personal DoH URL or DoT hostname.
How to set it up
- Windows 11: DoH is built in. In Settings → Network & internet → Wi-Fi (or Ethernet) → Hardware properties → DNS server assignment → Edit, choose Manual, enter the DNS addresses and set DNS over HTTPS to on, with your provider's template. Repeat for each adapter the laptop uses. Changing it needs an administrator account.
- Mac, iPhone and iPad: install a configuration profile from your provider. It sets encrypted DNS for the whole device. On iPhone and iPad, open the profile link, then install it from Settings.
- Android 9 and later: Settings → Network & internet → Private DNS (the menu name varies by manufacturer) → Private DNS provider hostname, then enter the device's DoT hostname.
- Chromebook: turn on secure DNS in Settings (under security and privacy) and choose a custom provider.
Encrypted DNS is light. There's no app running and no noticeable effect on speed. But it only covers lookups. Everything else still travels over the café's network as normal, protected by each website's own encryption. And a user with admin rights on the device can switch it off.
Captive portal tip: if a hotel or airport sign-in page doesn't appear, try opening any plain website to trigger it. If it still won't load, switch encrypted DNS (or the VPN) off, sign in to the Wi-Fi, then switch it straight back on.
Option 2: a VPN with filtering
A VPN sends all of the device's traffic through an encrypted tunnel to a server elsewhere. The local network sees only scrambled data going to one address. If the VPN's DNS is your filtering provider, your policy applies too.
This is the better fit when the whole connection should be protected, not just the lookups: staff who work from hotels and airports every week, people handling sensitive data, or anyone who regularly joins networks they don't trust. The trade-offs: there's an app to install and switch on, traffic goes the long way round through the VPN server, and websites see the server's location rather than yours.
A VPN is also the most common way devices bypass DNS filtering. If staff use personal VPNs, your filter can't see their lookups. See how to stop DNS filtering bypass.
How to choose, per person
| Who | Good fit |
|---|---|
| Mostly in the office, occasionally at home | Encrypted DNS on the laptop. Set it once and forget it. |
| Phones and tablets | Encrypted DNS (profile or Private DNS). Covers mobile data too. |
| Frequent travelers, hotel and airport Wi-Fi | A VPN with filtering, ideally with encrypted DNS as well for when it's off. |
| People handling sensitive data on the road | A VPN with filtering. |
Many organizations use both: encrypted DNS as the default, and a VPN for the people who need it.
Protect laptops anywhere.
Start freeHow DNSAFE does both
Roaming devices (encrypted DNS)
On business and MSP plans, open the network in the portal and use Roaming devices → Add device. Each laptop or phone gets its own DoH address and DoT name, and DNSAFE recognises it by that ID on any network, with your network's rules and logs. The portal shows the steps for each device type: a profile link for iPhone, iPad and Mac, Private DNS for Android, and the DoH setting for Windows 11 and Chromebook. There's no agent to install. Each roaming device counts as one IP on your plan, and if a device is lost you can reset its setup so the old address stops working. Details: DoH and DoT in the docs.
On Home plans, go to Devices → Add a phone, tablet or laptop at my.dnsafe.net. See the Home guide.
Secure Wi-Fi (VPN)
Secure Wi-Fi is a WireGuard VPN built for untrusted networks, with your DNSAFE filtering on. It uses the free WireGuard app, so there's nothing of ours to install.
- Your policy applies. Lookups use the network's DNSAFE policy and appear in its query logs. A browser's own secure DNS and iCloud Private Relay can't route around DNSAFE while it's on, and the block page shows your organization.
- Up to 5 devices per person (or per Home account), with 200 GB a month of fair use. If someone reaches it, Secure Wi-Fi pauses until the 1st and normal DNSAFE protection carries on.
- Servers in Germany, run by Hetzner. Websites see the server's address, not the device's.
- Pricing: included with Business Enterprise and MSP Enterprise; $2 per person a month on other paid business and MSP plans, counted only for people with a device. For Home, it's included with Pro and a $3.99/month add-on on Personal and Family. See pricing.
To invite someone, open the network, choose the Secure Wi-Fi tab and send a setup link. See Secure Wi-Fi in the docs.
To check a device is protected wherever it is, run the DNS leak test.
Frequently asked questions
Is public Wi-Fi safe to use for work?
Usually, for everyday tasks. Most sites and apps encrypt their traffic, so others on the network can't read it. The gaps are DNS: lookups go to a server you don't control, unencrypted and unfiltered. Encrypted DNS to your filtering provider, or a VPN with filtering, closes them.
Do I need a VPN if I already use encrypted DNS?
Not always. Encrypted DNS keeps your filtering on and hides your lookups from the local network. A VPN also encrypts everything else and hides which servers you connect to. For frequent travelers or sensitive work, use both.
Why does the hotel sign-in page not appear?
Captive portals intercept traffic until you accept their terms, and encrypted DNS or a VPN can get in the way. Try opening a plain website first. If that fails, switch encrypted DNS or the VPN off, sign in, then switch it back on.