DNS Privacy

When you visit a site, your device must first turn a name into an address. That lookup is plaintext by default, and it happens before any encryption to the site can begin. It is therefore the most reliable thing a network can observe about you, for free.

What DNS reveals

A resolver sees the name you asked for and where the request came from. A network operator sees the same thing, plus timing, and plus the IP address you then connect to. Together, name lookups and connections describe your browsing in detail without any content being read.

What encrypted DNS changes

DNS over TLS (RFC 7858) and DNS over HTTPS (RFC 8484) wrap resolution in a transport the resolver must authenticate. The local network and the ISP then see only that a connection to a named resolver exists.

This is a real and worthwhile improvement. It is also frequently oversold:

Choosing a resolver

Configuring it

In Firefox, which ships with its own resolver rather than using the system one:

// about:config
network.trr.mode                          = 3   # 3 = DoH only, 2 = opportunistic
network.trr.uri                           = "https://dns.example/dns-query"
network.trr.custom_uri                    = false
network.trr.excluded-domains             = ""   # no fallbacks
network.trr.strict_native_fallback        = true

In Chrome, the setting is Secure DNS, and it offers a choice of provider — read the list before selecting, since it is a list of companies gaining visibility into your lookups.

On a Linux host with systemd-resolved, unencrypted DNS should be routed to the local stub listener rather than used directly:

# /etc/systemd/resolved.conf
[Resolve]
DNS=1.1.1.1
FallbackDNS=
DNSOverTLS=yes
DNSSEC=allow-downgrade

Verifying

• DNS leak tests show which resolvers observed a lookup. A correctly configured client should show only the resolver you chose.
• Query the special names your resolver provides to report its own identity, if it has them.
• Watch the connection in a packet capture on a trusted network, not in production.

Sources

• RFC 8484 — DNS over HTTPS, including the threat model it addresses and the residual exposure it acknowledges.
• RFC 7858 — DNS over TLS, and why port 853 and certificate validation are part of the design.
• RFC 1035 — the original specification, with no security considerations to speak of.
• Firefox DNS over HTTPS — the current settings and what each network.trr.mode value means.