Portmaster automatically encrypts all your DNS queries to safeguard them from prying eyes. Portmaster sets a default provider, but you can always switch to a custom DNS-over-TLS provider in the global settings.