Encrypted DNS sounds like an easy privacy win if you set it up correctly, and it is, but please don't treat it as some bulletproof, foolproof solution that hides everything you do from everyone who might want to know.In fact, it doesn't hide your browsing from your ISP.Your ISP still carries the connection, so there's still a lot of information on the table.
But if encrypted DNS isn't the fix here, then what is? Encrypted DNS only protects the lookup Your browser still has to connect somewhere Close DNS is everywhere, and it comes in the moment you type a website address into your browser, because your device needs to figure out what IP address belongs to that domain.And traditionally, those requests -- because that's what they are -- are sent in plaintext.As a result, your ISP or another network operator can see what you're asking for.
For some, this isn't a problem, but for the more privacy-inclined of us, this isn't great.Realistically, I do know that my ISP has better things to do with their time than to spy on what I'm doing, but well ...the more time goes on, the more I value my online privacy.
I digress.DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt those requests.This prevents anyone along the path between you and the website from reading them.
Neat, right? But this is just one small part of loading a website.Your browser still has to establish a connection to that server.Unsurprisingly, as that traffic happens online, it goes through your ISP.
The bottom line here is that encrypted DNS may prevent your ISP from reading that DNS request itself, sure.But it can't conceal the rest of your connection, because your browser still needs the internet to load the website contents in the first place.Related This is how they know you're using a VPN It's not an invisibility cloak.
Posts 2 By Sydney Butler Your ISP still has access to a lot of information The destination IP never disappeared Just like you probably don't want your work laptop to let your employer explore your home network, it's only natural that you'd rather limit what your ISP can see.Unfortunately, and unsurprisingly, your internet service provider can see a whole lot, encrypted DNS or not.First and foremost, the ISP can see destination IP addresses of every service and website you connect to.
It also knows when those connections happen and how long they last, plus how much data goes in either direction (in/out).Many variables make it so that the ISP may not be able to cleanly see every single website you visit.For instance, an IP address doesn't always map to just one website.
But the ISP still gets a boatload of info on your browsing patterns, and encrypted DNS alone doesn't conceal all of that.In fact, all the things I mentioned above are unaffected by encrypted DNS.Running your own DNS server doesn't fix this Unbound can't hide the traffic leaving your house Online privacy is like layers upon layers, so if we're digging deeper, self-hosting your DNS sounds like an obvious next step.
But does that fix your problems here? Nope, but you can still try it out anyway.Doing this means replacing trusting your ISP's resolver or using Google or Cloudflare with running something like Unbound, which will then resolve domains recursively, and it's especially good when used with Pi-hole or AdGuard Home, as that gives you some extra control over logging, filtering, and local DNS.Don't get me wrong, it's a good setup, but the caveat remains the same as before: that traffic still has to go through your ISP if it sits inside your home network.
Even when Unbound fetches you the IP address you're looking for, your browser still uses that same internet connection to get you there, so you're not cutting out the ISP in this particular equation.For that, you need to tunnel more than just DNS.A full-tunnel VPN actually changes what your ISP can see The ISP sees the tunnel instead of every destination This brings me to what I truly think is the solution here: a full-tunnel VPN.
What this does is it basically encrypts your entire traffic, not just the DNS portion of things.You no longer connect directly to every website or service, because the VPN sits there in between you and the target, receiving that traffic first.Your ISP will still know you were using the internet and when, but they won't know what you were doing online -- not to the same extent.
It won't be served a full list of destination IPs, at the very least.The VPN server works as your exit point to the internet at large, and its jobs are aplenty, including receiving encrypted traffic and forwarding it to the website you're trying to reach.The response goes back the same way -- through the tunnel -- so you've effectively moved from having to trust your ISP to trusting whoever operates the VPN server.
In the end, you still have to trust someone, but you don't have to use a commercial VPN for this.You can self-host the exit point instead.Quiz8 Questions · Test Your KnowledgeDNS servers & how the internet finds its wayTrivia challengeFrom 8.8.8.8 to how your browser finds cat videos — find out how much you really know about DNS.DNS BasicsIP AddressesSecurityProvidersHistoryBegin01 / 8DNS BasicsWhat does DNS stand for?ADigital Network SecurityBDomain Name SystemCDistributed Node ServiceDDynamic Naming StandardCorrect! DNS stands for Domain Name System — the internet's giant phone book that translates human-friendly domain names like 'howtogeek.com' into IP addresses computers can actually use.
Without it, you'd need to memorize a string of numbers every time you wanted to visit a website.Not quite — DNS stands for Domain Name System.It acts like the internet's phone book, converting easy-to-remember domain names into the numerical IP addresses that computers use to route traffic.It's one of the most fundamental building blocks of the modern web.Continue02 / 8HistoryBefore DNS was invented, how did computers resolve hostnames on the early internet (ARPANET)?AEach router kept its own lookup tableBUsers typed IP addresses directly every timeCA single text file called HOSTS.TXT was downloaded from a central serverDA broadcast message was sent across the network asking for the addressThat's right! Before DNS, every computer on ARPANET relied on a file called HOSTS.TXT maintained by the Stanford Research Institute.
Admins had to manually download the updated file to get new hostname mappings — not exactly scalable once the network started growing rapidly.The answer is HOSTS.TXT.Before DNS existed, a single text file maintained at the Stanford Research Institute mapped all hostnames to addresses, and every machine had to download it periodically.As the internet grew, this system became completely unmanageable, which is exactly what motivated the creation of DNS in 1983.Continue03 / 8ProvidersThe famous DNS server at IP address 8.8.8.8 is operated by which company?ACloudflareBOpenDNSCGoogleDMicrosoftCorrect! 8.8.8.8 (and its companion 8.8.4.4) is Google's Public DNS service, launched in 2009.
It was one of the first major free public DNS resolvers and became incredibly popular as a fast, reliable alternative to ISP-provided DNS servers.The 8.8.8.8 address belongs to Google's Public DNS, launched in 2009.Google made 8.8.8.8 easy to remember on purpose.Cloudflare runs 1.1.1.1, OpenDNS uses 208.67.222.222, and Microsoft's Azure DNS exists but isn't the same service — each provider pitches slightly different benefits like speed, privacy, or filtering.Continue04 / 8ProvidersCloudflare's DNS resolver at 1.1.1.1 launched in 2018 with a strong emphasis on what selling point?ABuilt-in ad blocking for all usersBUser privacy and not logging IP addressesCFaster speeds guaranteed by a global CDNDParental controls enabled by defaultSpot on! Cloudflare launched 1.1.1.1 on April 1, 2018 (yes, really) with privacy as its headline feature, promising never to log users' IP addresses or sell browsing data.
It was independently audited by KPMG to back up those claims, which set it apart from many competitors.Cloudflare's big pitch for 1.1.1.1 was privacy — specifically the promise to never log users' IP addresses or sell their data.While 1.1.1.1 is also very fast (often ranking #1 in independent speed tests), privacy was the headline claim at launch, backed by a third-party audit from KPMG.Ad blocking is available via a separate 1.1.1.2 address, but it's not on by default.Continue05 / 8DNS BasicsWhat is a DNS 'resolver' (also called a recursive resolver)?AThe server that stores the original authoritative records for a domainBA piece of hardware inside your router that caches all domain names locallyCThe server that does the legwork of querying other DNS servers on your behalfDA security certificate that verifies a domain name is legitimateExactly right! A recursive resolver (like 8.8.8.8 or 1.1.1.1) is the middleman that takes your query and chases down the answer by contacting root servers, TLD servers, and authoritative nameservers — then delivers the final IP address back to you.
It does all the heavy lifting so you don't have to.A recursive resolver is the server that does the legwork on your behalf — it contacts root nameservers, top-level domain servers, and authoritative nameservers in sequence until it finds the IP address you need.The authoritative nameserver is the one that actually holds the official records.Your resolver is essentially the internet's investigator, tracking down answers one clue at a time.Continue06 / 8SecurityWhat type of attack involves poisoning a DNS cache with false records to redirect users to malicious websites?ADNS spoofing (cache poisoning)BDDoS amplificationCBGP hijackingDARP floodingCorrect! DNS spoofing, also known as cache poisoning, tricks a DNS resolver into storing a fraudulent IP address for a legitimate domain.
When users then request that domain, they're silently redirected to a malicious server — which is exactly why DNSSEC was developed to cryptographically sign DNS records.The attack you're thinking of is DNS spoofing or cache poisoning.An attacker injects fake DNS records into a resolver's cache, causing anyone who queries that resolver to be directed to the wrong — often malicious — IP address.DNSSEC (DNS Security Extensions) was designed specifically to fight this by adding cryptographic signatures to DNS records.Continue07 / 8DNS BasicsWhich DNS record type is responsible for mapping a domain name to an IPv4 address?AMX recordBCNAME recordCA recordDTXT recordRight on! The 'A' record (short for Address record) is the most fundamental DNS record type, mapping a hostname directly to a 32-bit IPv4 address.
Its cousin, the AAAA record, does the same job for 128-bit IPv6 addresses — you'll sometimes see both configured for the same domain.The correct answer is the A record (Address record), which maps a domain to an IPv4 address.An MX record handles mail routing, a CNAME is an alias pointing one domain name to another, and TXT records store arbitrary text — often used for things like SPF email verification or domain ownership confirmation.The A record is the bread-and-butter of DNS.Continue08 / 8SecurityDNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) both aim to solve the same core problem.
What is it?ADNS queries are too slow over long distancesBTraditional DNS queries are sent in plain text, making them visible to eavesdroppersCISPs charge extra for unencrypted DNS trafficDIPv6 addresses are too long for standard DNS packets to carryAbsolutely correct! Traditional DNS queries travel as plain, unencrypted text — meaning your ISP, network admin, or anyone monitoring traffic can see every domain you look up.DoH wraps DNS in HTTPS (using port 443), while DoT uses a dedicated TLS connection (port 853), both making your browsing queries much harder to snoop on.The core problem that DoH and DoT solve is that standard DNS queries are completely unencrypted and readable by anyone watching your network traffic — your ISP, a coffee shop Wi-Fi operator, or a government.DNS-over-HTTPS hides queries inside normal HTTPS traffic, while DNS-over-TLS uses a dedicated encrypted channel.
Both approaches protect your privacy at the DNS layer, which is surprisingly often overlooked.See My ScoreChallenge CompleteYour Score/ 8Thanks for playing!Try Again Self-host the exit point, not just the resolver A cheap VPS can become your private way out Hold up, hold up, I'm not done yet! If you want even more control, all you need is a cheap VPS, which replaces having to pay for a commercial VPN provider.(By the way, commercial VPNs are often quite good about no-logs policies, so your traffic is pretty okay anyway -- but still, it's not the same thing.) The way this works is you rent a small virtual server and then install something like WireGuard on it.You then configure all your devices to use this VPS as their full-tunnel VPN endpoint, and with Tailscale, you can configure the VPS as an exit node.
When this is all done, your normal internet traffic your DNS requests travel through the encrypted tunnel before reaching the internet at large (read: your ISP).Encrypted DNS adds privacy but doesn't replace everything else Encrypted and private DNS aren't some kind of fix for everything that could possibly go wrong.Instead, encrypted DNS is one piece of a very large puzzle.
In the end, it's down to you how many pieces of that privacy puzzle you're going to put together before you throw the rest out, and every little step helps.The above is a path to follow if you're really privacy-conscious and want to go the extra mile.
Read More
