VPN vs DNS Encryption: Secure DNS Found the Site, but Only the VPN Reached It

The upload stopped at 92 percent just as the bar downstairs erupted.

I was in a rented apartment in Valencia, sending the final design files for a Monday product launch. The client’s portal had accepted six gigabytes without complaint. Then, a few minutes after the football coverage began, the page turned white and displayed a connection timeout.

I blamed the browser.

I reopened the tab, cleared the cache and tried the portal in a private window. The homepage would not load. Neither would the project dashboard or the company’s status page.

Everything else seemed normal. Messages arrived. Search results opened. A video continued playing in another tab.

I already had encrypted DNS enabled, so I assumed the internet provider could not interfere with the site. To be safe, I changed to another encrypted resolver and cleared the laptop’s DNS cache.

The portal still timed out.

That was when “VPN versus DNS encryption” stopped sounding like a technical comparison. I did not need the most elegant way to conceal a domain lookup. I needed the final eight percent of the upload to reach the client before everyone logged off.

Secure DNS had done its job

The confusing part was that encrypted DNS had not failed.

When I entered the portal’s address, the laptop first had to translate its domain name into an IP address. DNS over HTTPS protected that request inside an encrypted connection, preventing the local network from casually reading or replacing the lookup.

The resolver returned the correct address.

The browser then tried to connect to it, and that connection timed out.

I had always treated those actions as one event: find the website, then open it. The network treated them as two separate stages.

Encrypted DNS protected the first. It did not change the route used by the second.

The timing supplied the missing clue. The interruption had started during a football broadcast in Spain.

The block happened after the lookup

Spanish internet providers have been implementing court-backed IP blocking during LaLiga matches as part of the league’s campaign against illegal streaming. LaLiga says the measures target infrastructure supporting piracy. Cloudflare has argued that blocking shared IP addresses also takes unrelated websites offline.

OONI measurements have shown how wide that collateral damage can become. When many websites share the same hosting infrastructure, blocking a small group of IP addresses can make large numbers of unrelated domains unreachable during a match.

That matched what I was seeing.

The client portal did not need to be a piracy target. It only needed to share infrastructure with an address that had been blocked. Both encrypted DNS services gave my laptop the same legitimate destination, but the broadband connection would not carry traffic there.

A brief public account from a Madrid developer described the practical pattern clearly: DNS resolution continued to work, Cloudflare-hosted addresses timed out during matches, and access returned after the traffic was routed through a VPN.

I stopped changing resolvers.

The lookup was private. The route was still blocked.

Another DNS setting could not move the file

I opened the portal on my phone with Wi-Fi disabled.

It loaded immediately over mobile data.

That ruled out the client account, the browser and the portal itself. The page worked through another network because the phone was no longer following the apartment broadband’s blocked route.

Tethering the laptop was possible, but the mobile signal inside the building was weak. Restarting a six-gigabyte transfer over it could take longer than the deadline allowed.

I tested the apartment connection once more. The encrypted-DNS indicator remained active. The portal remained unreachable.

By then, the distinction was simple.

DNS encryption protects the request that asks where a domain is located. It does not reroute the browser’s connection to that location. Once the destination address itself is being blocked, changing the resolver only produces a private answer to a route the network still refuses to carry.

The portal had been found correctly every time.

I needed a different way to reach it.

The smaller app changed the route

I had OnlydogVPN installed as a backup from earlier testing.

The service has fewer server locations and a shorter public history than the largest VPN providers. In this situation, however, a long country list was not what I needed. I needed a route that worked on the restricted connection in front of me.

I opened the app and selected the preset for a restricted network. There was no conventional email-and-password registration step delaying the connection.

Then I returned to the client portal.

The dashboard appeared.

The partial transfer was still recorded, and the portal offered to resume from 92 percent. I clicked the button.

Ninety-four.

Ninety-seven.

Complete.

The client’s automated confirmation arrived before the cheering downstairs had stopped.

The difference was visible before I looked at any technical explanation. The VPN had carried the browser session through an encrypted route to another exit point. The apartment provider was no longer connecting my laptop directly to the blocked destination.

The smaller app also combines an HTTP/3-based transport with additional traffic obfuscation. In practical terms, it was built for the kind of network that does more than answer DNS requests—it actively decides which connections should proceed.

Secure DNS had told my laptop where the portal was. The VPN gave the upload another road to get there.

The second benefit appeared after the deadline

With the files delivered, I opened the client’s help centre to confirm that the archive had passed its integrity check.

While I moved between the portal, its documentation and webmail, the app’s blocked-request counter continued rising. Advertising and tracking requests were being filtered before they reached the browser.

I could not observe every internal filtering rule behind the counter. I could see that the pages I needed continued loading while fewer unrelated requests joined the session.

That was not what rescued the upload. It solved a smaller irritation afterward: less background traffic while I checked the files and sent the final message.

A few minutes later, the match reached halftime.

The portal began loading over the direct apartment connection again.

Nothing had changed in my browser. The DNS resolver was returning the same address. The temporary network block had simply lifted.

By then, the comparison was settled.

VPN or DNS encryption?

DNS encryption is useful when the problem is the lookup itself.

It prevents the local network from casually reading or manipulating traditional DNS requests. For ordinary browsing on a network that is not blocking the resulting destination, that may be exactly the protection a user wants.

A VPN handles the larger connection.

It protects and reroutes the session after the lookup has finished. That distinction becomes decisive when a provider blocks destination IP addresses, restricts particular traffic or makes a correctly resolved site unreachable.

In Valencia, both encrypted DNS services found the client portal. Neither could move the remaining files through the blocked broadband route.

The smaller app changed that route, reopened the dashboard and delivered the final eight percent.

Secure DNS knew where my files needed to go. The VPN was the tool that got them there before the match—and my deadline—moved on.