That was my take on it too. The first resolver knows who you are, so can return the DNS query response but not the actual query itself as it’s encrypted. The ex

That was my take on it too. The first resolver knows who you are, so can return the DNS query response but not the actual query itself as it’s encrypted. The exit resolver (exit node if you will) knows the DNS query but not the original source of the request, since it came from the first resolver. So at this point it looks like the idea of onion routing applied to DNS queries. Sound about right?