My original though as well. But eventually I prefer the DNS resolver to just forward whatever the DNS server says. Therefore, the issue can be said to lie in th

My original though as well. But eventually I prefer the DNS resolver to just forward whatever the DNS server says. Therefore, the issue can be said to lie in the DNS protocol. But still, whatever the protocol, the browser is the program that does something privacy sensitive by basically being used as a remote code execution tool, and it should not trust whatever information from whatever source, including name resolution regardless of the protocol. Therefore the browser trusting DNS when something obviously shady is going on (such as a resource ip changing to 127.0.0.1) is a bug in the browser, I think. I would feel safer, for instance, if the same origin policy would apply to the same TCP connection for instance, so that no amount of name or IP spoofing could work. Of course internet giants would not like it, but that would be their problem not mine, and really not so hard to solve.