There are multiple different types of secure DNS. DNS-over-HTTPS, DNS-over-TLS, DNSCrypt, DNSCurve, DNSSEC. Some of them don't even protect the client's traffic

There are multiple different types of secure DNS. DNS-over-HTTPS, DNS-over-TLS, DNSCrypt, DNSCurve, DNSSEC. Some of them don't even protect the client's traffic (you at a coffee shop). DNS-over-HTTPS (DoH) has been getting a lot of publicity lately since Chrome and Firefox started supporting it, but it's only activated sometimes. Many people don't like it: https://news.ycombinator.com/item?id=22414912 https://news.ycombinator.com/item?id=22414912 Another thing: even if your browser is using DoH 100% of the time, that's not good enough. Other things can use the public suffix list, such as a commandline go program that makes http requests[1]. If that program isn't using DoH then it's now vulnerable. Most programs use the DNS resolution capabilities provided by your operating system. I don't think any operating systems by default use DoH. [1] https://golang.org/pkg/net/http/cookiejar/#PublicSuffixList https://golang.org/pkg/net/http/cookiejar/#PublicSuffixList