The Limits of DNS Privacy: Why Changing Your Resolver Is Not a Total Cloaking Device

However, HTTPS does not hide the IP address of the server being contacted. Every packet sent over the internet must have a destination address to be routed correctly. Because the ISP is responsible for that routing, it can see the IP addresses of every service a user accesses. While a single IP address might host thousands of small websites via a Content Delivery Network (CDN), many major services—such as Netflix, Facebook, or specific banking portals—use dedicated IP ranges that are easily identifiable. Through simple IP mapping, an ISP can build a remarkably accurate profile of a user’s habits without ever seeing a single DNS query.

Beyond IP addresses, the TLS protocol itself has historically had a "leakage" problem. During the initial "handshake" when a browser connects to a server, it often sends a piece of information called Server Name Indication (SNI). SNI tells the server which specific website the user wants to see, which is necessary when one server hosts multiple domains. For years, this SNI field was sent in plain text, allowing ISPs to see the exact hostname of the site being visited, even if the rest of the session was encrypted.

The industry has responded with Encrypted Client Hello (ECH), a development designed to encrypt the SNI and other sensitive parts of the TLS handshake. While ECH is a significant leap forward for privacy, it is not yet a universal standard. Its effectiveness is contingent upon support from the browser, the web server, and the underlying network infrastructure. Until ECH is ubiquitous, the "destination" remains a visible data point for those managing the network.

Furthermore, sophisticated traffic analysis can fill in the gaps. Even when the content and hostnames are hidden, the timing, size, and direction of data packets create a "fingerprint." An ISP’s analytical tools can often determine if a user is streaming high-definition video, participating in a VoIP call, or downloading large files, and can sometimes match these patterns to known services. Thus, while encrypted DNS solves a specific problem of visibility, it does not render the ISP blind.

Changing DNS means trusting someone else

A common oversight in the move to third-party DNS is the shifting of trust. When a user stops using an ISP’s resolver, they are not eliminating the collection of DNS data; they are simply choosing who collects it. If you configure your system to use Google Public DNS, Google becomes the entity that sees every domain you intend to visit. If you use Cloudflare, Cloudflare receives that information.

The new resolver can still see your queries

While DoH and DoT protect the queries during transit, the resolver itself must decrypt the request to provide an answer. This makes the provider’s internal policies a critical factor for privacy-conscious users. Every DNS provider operates under a specific jurisdiction and legal framework, which dictates how they handle data and how they must respond to government or law enforcement requests.

The privacy policies of these providers vary wildly. Some providers, like Quad9, emphasize their commitment to not logging IP addresses and being based in privacy-friendly jurisdictions like Switzerland. Others may have more permissive logging practices or may be subject to different data retention laws. While many public DNS providers are arguably more trustworthy than a local ISP—especially in regions where ISPs are known to sell browsing data to advertisers—the user is still placing their digital footprint in the hands of a third party.