Secure DNS and VPNs are often grouped as privacy tools, but they operate at different layers. DoH or DoT encrypts domain lookups to a resolver. A VPN can route device or application traffic through a VPN server.
Secure DNS
Useful against local observation or alteration of DNS queries. The resolver still sees requests, and later connections remain visible through other metadata.
VPN
Protects traffic between the device and VPN endpoint and normally carries DNS through that route. The VPN operator becomes a broader intermediary.
Use both?
A well-configured VPN usually supplies its intended resolver. A separate browser DoH service changes the resolver that receives the queries and may conflict with VPN DNS policy. Its HTTPS connection can still travel inside the VPN; changing resolver alone does not prove a tunnel leak. An excluded route or application can send it outside the tunnel. Test the actual route instead of stacking settings blindly.
Managed devices
Do not override organizational DNS or VPN controls. They may provide threat blocking, private-domain resolution and audit requirements.
Choose secure DNS for resolver privacy and integrity; choose a VPN for wider network routing. Neither replaces HTTPS or careful account security.
A concrete example
On café Wi-Fi, DoH can stop the hotspot from reading or altering ordinary DNS queries, while the network still sees connections leaving the device. A VPN moves that local trust boundary to the VPN server for broader traffic. HTTPS continues to protect content to the destination in either design.
How to verify
Check the active resolver, public IP and DNS leak behavior before and after changes. Run one controlled test at a time so an unexpected result has an identifiable cause.