4 ms·

Meaning, if you don't want people to know you are searching for snm.donkeyporn.com than going out to the nameserver that donkeyporn is using is not exactly kee

• viraptor 6y ago
  In practice with 1.1.1.1 you're trading the parties who know about your access from: Donkeyporn's DNS provider, com's DNS provider (0.1% chance it's not already cached), your ISP, transit providers, donkeyporn's ISP, donkeyporn service To: cloudflare, your ISP, transit providers, donkeyporn's ISP, donkeyporn service It's not a huge change and it's really about whether you trust CloudFlare more than the service donkeyporn has chosen.
  • minerjoe 6y ago
    I though correctly switching to cloudflare should just be me -> cloudflare via an encrypted channel?
    • viraptor 6y ago
      If you're talking about clouflare warp, then yes... kind of. If you mean only the DNS, them no, there are still many connections matching you to the destination.
• Arnavion 6y ago
  You are correct that if you run your own resolver, then all the DNS traffic from your resolver to other nameservers is in cleartext. DoH and DoT only get used by forwarders.
• _-___________-_ 6y ago
  Worth noting that until Encrypted SNI is universally used, you probably transmit snm.donkeyporn.com in the clear when your browser does the initial TLS exchange anyway. I personally feel that concentrating all the information of "what DNS names are people looking up" into the hands of a few parties (e.g. CloudFlare) makes it much easier to collect and analyze this information.