DNS in plain terms: name-to-address translation

DNS (Domain Name System) is how your device finds an IP address for a domain name like example.com. When you type a website name, your operating system or browser typically asks a DNS resolver to look up the corresponding IP address. After that, your device connects to the IP address to fetch the content.

DNS primarily answers a practical question (“which address belongs to this name?”). It also creates metadata that can reveal what names you are trying to reach, depending on where the DNS queries go and how they are protected.

How DNS can affect security

DNS can influence security in two main ways.

  1. Privacy and visibility of lookups: If DNS queries are visible to an observer (for example, through unprotected or unintended resolution paths), the observer may infer which domains you access.

  2. Integrity of resolution: DNS results should be accurate and hard to tamper with. If an attacker can interfere with DNS responses, they may redirect you to a different IP address than expected.

Because DNS is part of the process before a connection is made, protecting DNS often matters for reducing exposure even when your final traffic is encrypted (e.g., by HTTPS).

VPN in plain terms: encrypted transport

A VPN (Virtual Private Network) creates an encrypted tunnel between your device and a VPN server. Once the tunnel is established, your internet traffic is carried through that encrypted connection, so the networks between your device and the VPN server generally cannot read the contents of your browsing sessions.

From a practical standpoint, a VPN changes who can see and interpret your traffic in transit: observers on your local network or on the path to the VPN server typically see encrypted traffic rather than the underlying web activity.

Differences and limits: where protection helps—and where it doesn’t

DNS and VPN protect different parts of the picture.

  • DNS vs. traffic content: DNS mostly affects name resolution and lookup visibility, while a VPN mainly affects traffic confidentiality in transit.
  • Different threat models: A VPN doesn’t automatically fix issues like malware on your device, insecure account logins, or malicious sites that you visit knowingly or unknowingly. Encryption in transit doesn’t replace endpoint security.
  • DNS behavior can be a deciding factor: If DNS queries are handled outside the VPN tunnel (depending on configuration and client behavior), an observer may still learn domains you attempted to reach. This is why “DNS leakage” concerns exist: the protection you expect from a VPN can be reduced if DNS resolution doesn’t follow the intended path.

Importantly, there is no single setting that provides “complete” or “guaranteed” safety. Protections reduce certain risks, but other attack paths can remain.

Practical checks you can do

  1. Observe where DNS queries go: In your device’s network settings (and any VPN client settings), check which DNS resolver is used and whether DNS resolution is expected to occur through the VPN tunnel.
  2. Confirm VPN is actually used for your browsing: Make sure the VPN is enabled before accessing sites, and watch for indicators in the VPN client that the tunnel is active.
  3. Separate encrypted transport from account safety: Even with a VPN, use strong authentication practices for accounts (for example, avoiding reuse of passwords and using additional verification where available).

Answer in one sentence

DNS finds the addresses for domain names, and a VPN encrypts your traffic between your device and a VPN server; together they can reduce certain visibility and tampering risks, but they can’t eliminate all threats.