DNS Privacy: The Hidden Tracking Layer Most People Ignore — and How to Fix It

Before your browser can connect to any website, it needs to translate the domain name (like google.com) into an IP address. This translation is performed by the Domain Name System (DNS) — and by default, it happens in plaintext, unencrypted, over port 53. This means your DNS queries — a complete record of every domain you look up — are visible to your ISP, your router, anyone on your local network, and any network equipment between you and your DNS resolver. It's one of the most significant and least-discussed privacy gaps in everyday internet use.

Why DNS privacy matters even with HTTPS: many people assume that because their web traffic is encrypted with HTTPS, their browsing is private. But HTTPS encrypts the content of your connections — not the DNS lookups that precede them. Your ISP can see every domain you look up even if they can't see what you do on those sites. DNS data is also used for content filtering, parental controls, and — in some countries — government surveillance. Unencrypted DNS is a significant visibility gap that HTTPS alone doesn't close.

DNS-over-HTTPS (DoH) encrypts your DNS queries inside HTTPS traffic, making them indistinguishable from regular web traffic. Your ISP can see that you're making HTTPS connections to a DNS resolver's IP address, but cannot read the queries themselves. DoH is supported natively in Firefox (enabled by default since 2020), Chrome, Edge, and most modern browsers. You can configure your preferred DoH resolver in browser settings — Cloudflare (1.1.1.1), Google (8.8.8.8), or NextDNS are the most common choices.

DNS-over-TLS (DoT) is an alternative that encrypts DNS queries using TLS (the same protocol that underlies HTTPS) but on a dedicated port (853). DoT is more easily identified and blocked by network administrators than DoH — which is why DoH is generally preferred for consumer privacy. DoT is more common in enterprise and router-level configurations. Both protocols provide equivalent privacy protection; the choice between them is mainly about compatibility and whether you need to avoid detection.

Choosing a DNS resolver: Cloudflare's 1.1.1.1 is the fastest public DNS resolver and has a strong privacy policy — it commits to not selling DNS data and deletes query logs within 24 hours, with annual audits by KPMG to verify compliance. NextDNS is a more configurable option that lets you block trackers, ads, and malicious domains at the DNS level across all devices on your network — it's essentially a cloud-based Pi-hole. Quad9 (9.9.9.9) focuses on security, blocking known malicious domains automatically. Avoid using your ISP's default DNS resolver — it's the least private option.

System-wide encrypted DNS: browser-level DoH only protects DNS queries made by that browser. Apps, games, and other software on your device still use your system's default DNS resolver. For system-wide encrypted DNS on Windows, go to Settings > Network > DNS server assignment and select a DoH resolver. On macOS, you can configure DoH through a configuration profile or a third-party app like DNSCrypt-Proxy. On iOS and Android, both platforms support DoT natively in network settings. For whole-home protection, configure your router to use an encrypted DNS resolver — most modern routers support this in their DNS settings.