Well, the A/AAAA record and the host you're contacting aren't necessarily the same information, right? You could connect to 10 wildly different sites all behind

Well, the A/AAAA record and the host you're contacting aren't necessarily the same information, right? You could connect to 10 wildly different sites all behind a CDN and get the same A record for all of them, but vastly different results. It's the host, not the A/AAAA record, that leaks the most information in such a case. DoH/DoT plugs the host being leaked in the DNS packet, then. But of course, then the problem is punted to SNI, since your TLS Hello packet will probably send the host name with the setup packet, leaking the host then. So we're back to square one. To be fair, Firefox and Cloudflare are also working on ESNI, in which case, from what I understand, your DoH reply will include the A/AAAA record and the public key to encrypt SNI names with, which plugs that final major hole. So I think the A/AAAA record being exposed doesn't necessarily tank everything, but it certainly isn't perfect, either. But realistically none of these solutions were 100% perfect and a unique A/AAAA record was always going to expose you to a significant amount of side analysis, I think. In general, it just raises the bar and lets us place more trust in the "last hop" between you and the resolvers, much like many other improvements over the past few years, and originally envisioned by e.g. DNSCrypt. In general I feel the actual host header is more important than the A/AAAA record (it is at least more accurate), but I could be super wrong about that. (The more general discussion about a few major players being able to shape major internet changes for users like this, and general consolidation of the internet is, I think, extremely relevant. But also beyond just this particular exercise.)