The Limits of DNS Privacy: Why Changing Your Resolver Is Not a Total Cloaking Device

In the modern era of digital surveillance and data harvesting, internet users are increasingly seeking ways to reclaim their privacy. One of the most frequently recommended "quick fixes" in the tech community is changing the Domain Name System (DNS) server. By switching from a default Internet Service Provider (ISP) resolver to a third-party service like Cloudflare, Google Public DNS, or Quad9, users often believe they are making their browsing history invisible to prying eyes. However, the technical reality is far more nuanced. While changing a DNS provider is a valuable networking tweak for security and performance, it does not grant the total anonymity many users expect.

As technology writer and former DevOps engineer Umair Khurshid points out, the misconception that DNS changes hide browsing history remains prevalent. The fundamental architecture of the internet ensures that even with a private DNS resolver, ISPs, employers, and network administrators retain various methods to monitor connectivity. To understand why, one must look at the specific role DNS plays in the communication chain and where its protections begin and end.

DNS only tells your computer where to connect

At its core, the Domain Name System functions as the phonebook of the internet. Computers do not communicate using human-readable names like example.com; they use numerical IP addresses. When a user types a URL into a browser, the device must first ask a DNS resolver to translate that name into an IP address. By default, this request goes to the ISP’s servers. By changing the DNS settings on a router or individual device, a user redirects these "lookups" to a different provider.

Changing DNS changes the resolver, not the connection itself

The primary privacy benefit of switching resolvers comes from the adoption of modern, encrypted protocols. Traditionally, DNS queries were sent in "plain text," meaning anyone sitting on the local network—or the ISP itself—could see exactly which websites were being requested simply by intercepting the DNS packets. The introduction of DNS over HTTPS (DoH) and DNS over TLS (DoT) has changed this dynamic by wrapping these requests in a layer of encryption.

When DoH or DoT is enabled, the query between the user’s device and the chosen resolver (such as Cloudflare’s 1.1.1.1) is shielded. This prevents a local attacker on a public Wi-Fi network or a basic ISP monitoring script from reading the domain requests. However, this encryption only covers the translation phase. Once the resolver provides the IP address, the DNS’s job is finished.

The subsequent connection to the website’s server is an entirely separate process. After resolving the domain, the computer must still initiate a connection to the resulting IP address. These packets, which contain the actual data of the web session, must still travel through the ISP’s infrastructure to reach their destination. Changing the DNS resolver does not encrypt the metadata of these packets, nor does it hide the destination IP address. In this sense, while the "phonebook" lookup might be private, the "phone call" itself is still routed through the same provider.

Your ISP can still see plenty

The persistent visibility of an ISP is one of the most significant hurdles to total online privacy. Because the ISP provides the physical or wireless gateway to the broader internet, it sits in a privileged position between the user’s home network and the rest of the world. Even if the ISP no longer handles the DNS queries, it remains the carrier for every bit of data that leaves the premises.

HTTPS protects content, not necessarily your destination

Most modern web traffic is protected by HTTPS, which uses Transport Layer Security (TLS) to encrypt the data exchanged between a browser and a server. This ensures that an ISP cannot see the specific contents of a webpage—for instance, they cannot read the text of an email being sent via a webmail provider or see the specific products being viewed on an e-commerce site.