The Lookup Nobody Talks About: How Your DNS Requests Betray Every Website You Visit

When most Americans think about online privacy, they look for the padlock icon in the browser's address bar and assume the conversation is sealed. HTTPS encryption does protect the content of your communications — the login credentials you submit, the messages you type, the pages you read. But before any of that content moves a single byte, your device has to answer a more fundamental question: where, exactly, does this website live on the internet?

That question is called a DNS query. And for the vast majority of internet users in the United States, it travels across the network completely unencrypted — visible to your internet service provider, the operator of any Wi-Fi network you join, and, potentially, to surveillance infrastructure positioned anywhere along the route.

This is not a fringe vulnerability. It is the default behavior of virtually every connected device sold in America today.

What DNS Actually Does — and Why It Matters

The Domain Name System functions as the internet's address book. When you type a website address into your browser, your device does not inherently know the numerical IP address that corresponds to that name. It sends a query to a DNS resolver — typically a server operated by your ISP — asking for the translation. The resolver responds with the correct address, and your browser proceeds to load the page.

This exchange happens in milliseconds, invisibly, thousands of times per day on a typical household's devices. Most people never think about it. Therein lies the problem.

Because traditional DNS queries are transmitted in plain text, the resolver — and anyone capable of observing traffic between your device and that resolver — can compile a precise record of every domain name you request. That record does not reveal the specific article you read or the exact product you browsed, but it does reveal that you visited a particular news outlet, a mental health resource, a political organization's website, a financial institution, or a medical information service. In aggregate, that list is a detailed portrait of your interests, habits, concerns, and associations.

The ISP Angle: Why This Is a Commercial Problem, Not Just a Technical One

In the United States, the regulatory landscape for ISP data practices shifted significantly in 2017, when Congress voted to roll back Federal Communications Commission rules that would have required broadband providers to obtain explicit consent before collecting and selling customer data. That rollback remains in effect. Major ISPs are legally permitted to monetize the browsing data they observe — and DNS query logs represent some of the most granular behavioral data they can collect without breaking a single encryption seal.

This is not a hypothetical risk. Research from the International Computer Science Institute and other academic institutions has documented ISP-level DNS monitoring and data brokerage activity. The data that leaves your router in plain text does not disappear into a neutral void. It enters a commercial ecosystem.

Public Wi-Fi Makes the Exposure Worse

At home, your DNS queries travel to your ISP's resolver. On a public Wi-Fi network — at a coffee shop, an airport, a hotel, or a library — the situation becomes more precarious. The operator of that network controls the DNS resolver your device uses by default. A legitimately operated network still observes your query traffic. A maliciously operated one can do considerably more, including redirecting queries to fraudulent servers that return false addresses — a technique known as DNS spoofing or DNS hijacking — to intercept your traffic before it ever reaches the intended destination.

The HTTPS padlock you see in your browser only confirms that your connection to the correct server is encrypted. It offers no protection if DNS manipulation has already sent you to the wrong server in the first place.

The Solutions That Actually Work

The good news is that the technical community recognized this gap years ago and developed practical remedies. Two deserve particular attention.

DNS-over-HTTPS (DoH) encrypts DNS queries inside standard HTTPS traffic, making them indistinguishable from any other web request to a network observer. Major browsers including Chrome, Firefox, and Edge now support DoH natively, and enabling it requires only a few clicks in the browser's privacy or connection settings. Firefox, in particular, has enabled DoH by default for users in the United States, routing queries through Cloudflare's 1.1.1.1 resolver or, optionally, NextDNS.

DNS-over-TLS (DoT) achieves similar encryption at the operating system level rather than the browser level, meaning it protects queries from every application on the device, not just the browser. Android 9 and later versions support DoT natively through a feature called Private DNS, which can be configured in network settings.

Resolver choice matters as much as encryption method. Several reputable public resolvers are worth knowing:

• Quad9 (9.9.9.9), operated by a nonprofit organization, encrypts queries and blocks connections to domains known to host malware and phishing infrastructure. It does not log personally identifiable information.
• Cloudflare (1.1.1.1) offers strong privacy commitments, independent annual audits, and consistently fast performance. It also offers a variant (1.1.1.2) with malware-blocking enabled.
• Google Public DNS (8.8.8.8) is fast and reliable but operated by an advertising company whose business model is built on data. Its privacy commitments are more limited than the alternatives above.

For users who want system-wide protection — covering every app, not just the browser — a dedicated DNS filtering application or a router-level configuration is the more comprehensive approach.

What DNS Privacy Does Not Fix

It would be a disservice to overstate what encrypted DNS accomplishes. Even with DoH or DoT fully enabled, your IP address remains visible to websites you visit. Your ISP can still observe which IP addresses your device connects to, which — for large, single-tenant services — may allow reasonable inference about your activity even without domain names. Browser fingerprinting, tracking pixels, and third-party cookies operate entirely outside the DNS layer.

Encrypted DNS is one layer of a privacy posture, not the whole architecture. It is, however, an unusually high-impact layer given how little effort it requires to implement and how few users have done so.

The Practical Takeaway

The internet infrastructure that makes modern browsing possible was designed for functionality, not confidentiality. DNS was created in 1983, when the population of networked computers was small and the idea of commercial surveillance of user behavior was not a design consideration anyone anticipated. The protocol persisted for decades in its original, unencrypted form while the commercial and adversarial landscape around it transformed entirely.

Encrypting DNS queries will not make anyone invisible online. But it will close a specific, significant gap that most privacy-conscious Americans do not know exists — a gap through which their ISP, network operators, and potentially malicious actors read a detailed log of every digital destination they visit, every single day, without ever touching the content those destinations contain.

The padlock in the browser is real protection. It is simply not the whole story.