Encrypted DNS is DNS traffic carried inside a protected transport such as DNS over HTTPS (DoH) or DNS over TLS (DoT). Instead of sending domain lookups in plain text, the client and resolver encrypt the request so third parties on the network are less able to read, intercept, or modify it.
This matters because DNS is a high-value control point. Encrypted DNS helps protect privacy and can make DNS spoofing, hijacking, or simple observation harder on hostile Wi-Fi, ISP links, or shared networks. Defenders also use it to preserve integrity between trusted clients and resolvers. But it can complicate security policy: a router or firewall that expects to filter DNS may not see those lookups if a device uses its own encrypted resolver path. Attackers can also abuse encrypted DNS to hide command-and-control lookups from network monitoring, so organizations often pair it with endpoint controls and resolver policy.