SecretDNS is a free Windows program that encrypts DNS queries (DoH) and splits up the site name (SNI) in the first HTTPS packet. It leaves Windows network settings alone — just press the lock in the middle.
SecretDNS is not a VPN. It does not hide your IP address or encrypt all of your traffic. It handles only the two things inspection relies on: DNS and SNI.
A simplified illustration. It does not inspect your network or change any settings.
Your browser first asks a DNS server to turn the site name into an IP address. This query is normally not encrypted.
Even over HTTPS, the very first packet carries the name of the site you are visiting (SNI) in the clear.
Deep packet inspection (DPI) reads DNS and SNI to see where you are going, and can cut the connection or redirect you to a warning page.
Set DNS Config to DNS over HTTPS and press the lock: DNS queries are sent encrypted over HTTPS to a server such as Cloudflare. Nobody in between can read them. (Choosing Servers just uses a different DNS server, without encryption.)
Only the part holding the site name is sent in several fragments. The connection itself is unchanged, so there is almost no slowdown.
SecretDNS is not a VPN, so your IP and the rest of your traffic are untouched. When a site blocks you by country (error 451), use Mixed Proxy below.
It never changes your network adapter's DNS settings and works only while running. Turn it off and everything is back instantly — even after a power cut or forced shutdown, the internet works normally on the next boot.
Cloudflare by default. Add your own servers and tick several: if one stops answering, the next takes over. There is also a mode that uses a plain server (e.g. 1.1.1.1) without encryption.
Keeps the site name from showing as-is on HTTPS and HTTP connections. For networks where fragmenting alone isn't enough, there is Enable Fake Packet.
Sites that may break when fragmented, such as banking and payments, pass through untouched. More than 160 domains — banks, payments, portals, games, government, schools — are built in.
.example.comincludes subdomainshttps://www.example.com/pathpaste a URL, it gets cleaned upSwitch SNI Config to Fragmentⓜ and only the sites you list are fragmented.
Fragmentation applies only to major browsers such as Chrome, Edge, Firefox and Whale, leaving games and work apps alone. It is on by default, and DNS handling still applies to every program.
Before starting it checks that the DNS server is reachable, and the internet keeps working even if the server stops answering. No need to restart after sleep or a Wi-Fi change.
See how each site was handled, by DNS and SNI, in a table in its own window. Copy(All) pastes straight into Notepad or Excel.
| Type | Domain | Applied |
|---|---|---|
| DNS | www.example.com | DNS over HTTPS |
| SNI | www.example.com | Fragment |
| SNI | bank.example | |
| SNI | blocked.example | Direct |
It starts in the tray when Windows boots, and turns protection back on if it was running last time. Closing the window sends it to the tray; the icon is grey when stopped and gold when running.
Follows the Windows display language, or pick one under Language in Config — even while running.
In countries without internet freedom, some sites refuse connections from that country altogether and show error 451. Because the block is based on where you connect from, DNS encryption or fragmentation cannot open it.
Mixed Proxy routes only the domains you list through a server abroad. Everything else connects directly as usual, so other sites stay just as fast.
blocked.example — on the Mixed Proxy list, so it goes through a server abroad.
SecretDNS
Fragment SNI, a security vulnerability in HTTPS.
Config
DNS Config
SNI Config
Etc
Servers
Plain DNS server IP address (e.g. 1.1.1.1)
| Name | Address 1 | Address 2 | |
|---|---|---|---|
| Cloudflare | 1.1.1.1 | 1.0.0.1 | |
| 8.8.8.8 | 8.8.4.4 | ||
| Cloudflare | https://1.1.1.1/dns-query | https://1.0.0.1/dns-query | |
| cloudflare-dns.com | https://cloudflare-dns.com/dns-query | ||
| https://dns.google/dns-query |
| Type | Domain | Applied |
|---|---|---|
| DNS | www.example.com | Plaintext |
| SNI | www.example.com | Fragment |
| DNS | cdn.example.net | Plaintext |
| SNI | cdn.example.net | Fragment |
| SNI | bank.example | |
| DNS | blocked.example | Plaintext |
| SNI | blocked.example | Direct |
| DNS | img.example.com | Plaintext |
| SNI | img.example.com | Fragment |
| DNS | api.example.org | Plaintext |
| SNI | api.example.org | Fragment |
| DNS | static.example.net | Plaintext |
| SNI | static.example.net | Fragment |
| DNS | news.example | Plaintext |
| SNI | news.example | Fragment |
| DNS | shop.example | Plaintext |
| SNI | shop.example | Fragment |
| DNS | upstream | Connection restored |
A redrawn copy using the real program's layout, colors and wording. You can click around, but it doesn't actually do anything.
With the default settings (DNS Servers or DNS over HTTPS + SNI Fragment), pressing the lock fixes most cases. Turn on the Report and visit the site: the SNI row should show Fragment and the DNS row Plaintext or DNS over HTTPS. If it still fails, try Enable Fake Packet.
That site doesn't handle fragmentation well. In Config, add the domain to the exception list under the Fragment row and run again. Starting with a dot, like .example.com, covers every subdomain. You can also paste the URL from the address bar as-is.
Switch SNI Config to Fragmentⓜ and a target list box appears under that row. Only the domains you list are fragmented; everything else is sent as-is. If only one or two sites are a problem, this is the safer choice. If the list is empty, it asks you to add a domain before running.
Some office or school networks can't reach certain DoH servers. Tick a different server (e.g. cloudflare-dns.com) under Servers on the DNS over HTTPS row, or switch DNS Config to Servers. It isn't encrypted, but you still use a different DNS server without changing Windows settings.
Keep Browsers only on (it is on by default). Fragmentation and fake packets then apply only to major browsers. If a non-browser app such as a download manager also needs fragmentation, turn it off.
Pick one under Language at the bottom of Config and it switches right away — even while running. System follows the Windows display language.
This may be your browser's DNS cache. Close all browser windows and open them again.
SecretDNS.exeVersion 4.1.0
Version 4.0.6
Version 4.0.5
There are no automatic updates. If a new version is out, you are told when the program starts.
A VPN routes all your traffic through another server and changes your IP. SecretDNS doesn't hide your IP or encrypt all traffic — it handles only DNS and SNI, the two things inspection relies on. That's why there is almost no speed penalty.
Only the part containing the site name is split; the rest of the traffic is sent as usual, so there is almost no slowdown.
No. It doesn't change network adapter settings and works only while running. Even if you close it or the computer shuts down suddenly, everything is normal after a restart.
Yes. Unzip the portable version (ZIP) and run SecretDNS.exe. Apart from Run at startup being off by default, it is the same as the installer.
It is freeware, free to use without restriction at work, home, government offices or schools, and free to redistribute. Follow your organization's network policy.
No. On startup it checks for a new version and shows a notice; clicking Yes opens the download page.