It's worse than that: you already have to trust your ISP, but with third party DNS resolver you not only have to trust your ISP, but also another third party. E

It's worse than that: you already have to trust your ISP, but with third party DNS resolver you not only have to trust your ISP, but also another third party. Encrypted SNI is another sneaky proposal that claims it can help with that, but cannot actually. Even in the ideal case when everyone is using ESNI, there is still a lot of information that you have to trust your ISP with, like access patterns, IP addresses, response sizes, etc. and on top of that trust an extra third party with DNS. Basically it's all awful and ill-advised form security and privacy perspective, you always need at least a VPN if you can't trust your ISP. DoH can only make it worse.