> I strongly suggest using a third-party DNS provider as well. I don't know the exact equipment and mechanisms used by ISPs today, but it's extremely likely t

> I strongly suggest using a third-party DNS provider as well. I don't know the exact equipment and mechanisms used by ISPs today, but it's extremely likely that the surveillance works just based on sniffing every DNS packet, not just those sent to ISP resolvers. Someone with a better knowledge of the current state of the art is invited to comment :)