DNS Privacy: What It Can and Cannot Do
Changing your DNS improves safety but doesn't hide browsing history from key observers.
1DNS basics and limitations
DNS translates domain names to IP addresses, but changing providers doesn't make browsing invisible. ISPs, employers, or network admins can still track connections through other means. While DNS over HTTPS (DoH) or TLS (DoT) encrypts queries between device and resolver, it doesn't hide subsequent IP connections. The actual web traffic still passes through your ISP unencrypted unless additional measures like VPNs are used.
2ISP visibility remains
Even with encrypted DNS, ISPs can see destination IP addresses and sometimes infer services used. Dedicated IPs for specific services provide stronger clues than shared addresses. Traditional TLS connections expose hostnames through Server Name Indication (SNI) in ClientHello messages. While Encrypted Client Hello (ECH) improves privacy by hiding SNI, its effectiveness depends on browser, server, and infrastructure support. Traffic analysis of packet size and timing can also reveal connection patterns.
3Network control levels vary
Public Wi-Fi operators with encrypted DNS/HTTPS can't see specific pages but detect IP communications. ISPs have greater visibility, potentially seeing SNI and analyzing traffic patterns. Corporate/school networks can block outside DNS, log connections, or inspect traffic via managed devices. In controlled environments, local DNS changes may be overridden. VPNs shift trust to the provider while hiding individual destinations from ISPs, but DNS leaks can occur if misconfigured.
4Query destination shifts
Switching DNS providers redirects queries rather than eliminating them. Cloudflare or Google receive requests instead of your ISP when you use their public DNS. While DoH/DoT protects queries in transit, the resolver still sees requests, making provider policies crucial. Different providers operate under varying legal jurisdictions affecting data retention. Some prioritize privacy more than others, but no public DNS makes queries disappear entirely.
5Security vs privacy distinction
Encrypted DNS prevents local network observers from reading plaintext queries but doesn't anonymize browsing. It solves specific threats like DNS spoofing while leaving other tracking methods intact. Blocking known malicious domains provides security benefits against malware/phishing. However, treating DNS changes as complete privacy solutions creates false expectations. Comprehensive protection requires addressing multiple layers including IP visibility, SNI, and traffic analysis.
6Enterprise network realities
Organizations with network control can implement TLS inspection and traffic analysis regardless of user DNS settings. Managed devices may ignore local DNS configurations, rendering changes ineffective. Corporate proxies can decrypt and inspect HTTPS traffic when they control device certificates. In such environments, technical measures alone can't prevent monitoring, requiring policy discussions about acceptable workplace surveillance levels.
7VPN tradeoffs
VPNs encrypt all traffic to the provider, hiding individual destinations from ISPs. However, they shift visibility to the VPN provider, requiring trust in their policies. DNS leaks outside the tunnel can occur if configurations are incorrect. Some VPNs implement their own DNS resolvers with varying privacy guarantees. The choice between ISP or VPN provider visibility depends on threat models and trust in each party's data handling practices.
8Practical security approach
Encrypted DNS should be part of a layered defense rather than standalone privacy solution. Combining it with HTTPS, ECH, and VPNs provides incremental protection. Understanding each technology's scope prevents overestimating capabilities. For sensitive activities, assume any network operator can detect service-level connections. Truly hiding browsing requires considering legal jurisdictions, provider policies, and technical limitations across the entire connection path.
Original article: How-To Geek — DNS Privacy: What It Can and Cannot Do