Your default setup probably involves using your ISPs DNS resolver, which leaks your DNS queries to your ISP. Your ISP can also see which IP addresses you are co

Your default setup probably involves using your ISPs DNS resolver, which leaks your DNS queries to your ISP. Your ISP can also see which IP addresses you are connecting to and which website hostnames you're visiting thanks to unencrypted HTTP, and to SNI. You could re-point your DNS resolver to one of the public DNSCrypt resolvers, but by doing so, all you're doing is making it so that another party gets to see your traffic. Your ISP still knows what you're doing, but now your DNS provider knows too. From their own front page: Please note that DNSCrypt is not a replacement for a VPN, as it only authenticates DNS traffic, and doesn't prevent third-party DNS resolvers from logging your activity. By design, the TLS protocol, as used in HTTPS and HTTP/2, leaks websites host names in plain text, so DNSCrypt is not enough to hide this information.