Every website you visit starts with a DNS query. Most of them are logged. Your ISP sees every domain you resolve. Your DNS resolver sees every IP you connect to. The infrastructure of internet surveillance is built on DNS — the phone book of the internet that never forgets.
DNS was designed in an era of trust. The protocol sends queries in plaintext. The resolver logs every request. The ISP captures everything. The default configuration on most systems sends your browsing history to whoever runs the DNS server — usually your ISP.
THE DEEP DIVE
DNS Over HTTPS
DoH encrypts DNS queries by sending them over HTTPS connections. The resolver cannot see the queries in plaintext. The ISP cannot distinguish DNS queries from normal HTTPS traffic. The network observer sees only that you connected to a DoH resolver — not which domains you resolved.
# Configure DoH on Linux
# /etc/systemd/resolved.conf
[Resolve]
DNS=1.1.1.1#cloudflare-dns.com
DNS=9.9.9.9#dns.quad9.net
DNSOverTLS=yes
DNSSEC=yes
# Or use dnscrypt-proxy for more control
# /etc/dnscrypt-proxy/dnscrypt-proxy.toml
listen_addresses = ['127.0.0.1:53']
server_names = ['cloudflare', 'quad9']
静cache_size = 1000
[static]
[static.'cloudflare']
stamps = ['sdns://AgcAAAAAAAAABzEuMS4xLjEAEmNsb3VkZmxhcmUtZG5zLmNvbQ']
[static.'quad9']
stamps = ['sdns://AgcAAAAAAAAACzkLjkuOS45OQtéZWFzc3VwY2FzdC5jb20']DNS Leak Testing
Switching to DoH does not guarantee privacy. Your system may still leak DNS queries through other channels: systemd-resolved may bypass DoH for certain queries, the libc resolver may send direct queries, and browser DNS prefetch may ignore system settings.
PRINCIPLES
- DNS queries are metadata. Metadata is surveillance. Encrypt DNS or accept that you are being watched.
- DNSSEC is authentication, not privacy. It verifies the response is legitimate. It does not hide the query.
- DoH and DoT solve different problems. DoH hides DNS in HTTPS traffic. DoT encrypts DNS on a dedicated port.
- DNS caching is a privacy feature. A cached response means no network query. Maximize cache TTLs.
- Split-horizon DNS is common in enterprise environments. DoH may break internal name resolution.
IN PRACTICE
Browser-Level DoH
Firefox and Chrome both support DoH natively. Enable it in settings. The browser sends DNS queries over HTTPS to a resolver of your choice. The ISP sees only the HTTPS connection to the resolver, not the individual domains.
Network-Wide DoH
Run dnscrypt-proxy on your router. All devices on the network use DoH transparently. No client-side configuration needed. The ISP sees only HTTPS traffic to the resolver.
LIVE SIGNALS
These items surfaced from the intelligence pipeline at generation time.
- awesome-selfhosted — A list of Free Software network services and web applications which can be hosted on your own servers (GITHUB)
- CVE-1999-0095 — The debug command in Sendmail is enabled, allowing attackers to execute commands as root. (NVD / CVE)
- CVE-1999-1471 — Buffer overflow in passwd in BSD based operating systems 4.3 and earlier allows local users to gain root privileges by specifying a long shell or GECOS field. (NVD / CVE)
- CVE-1999-1122 — Vulnerability in restore in SunOS 4.0.3 and earlier allows local users to gain privileges. (NVD / CVE)
- CVE-1999-1506 — Vulnerability in SMI Sendmail 4.0 and earlier, on SunOS up to 4.0.3, allows remote attackers to access user bin. (NVD / CVE)
ANTIPATTERNS
- Using your ISP's DNS resolver. They log everything.
- Trusting 'private' DNS resolvers without verifying their privacy policy.
- Ignoring DNS leak testing. Switching to DoH does not mean you are private.
- Using DNS for access control. DNS-based blocking is trivially bypassed.
CHECKLIST
- System DNS resolver uses DoH or DoT
- Browser DNS settings are configured for DoH
- DNS leak test shows no plaintext queries
- DNS cache TTLs are configured to maximize privacy
- Internal DNS resolution is not affected by DoH changes
YOUR MOVE
Go to dnsleaktest.com right now. Run the extended test. If your ISP's name appears in the results, you are being surveilled. Fix it.