Yes it's key to separate both, but regardless they know DNS queries + can see all http traffic and TLS handshakes will reveal (in plaintext) the name of sites c

Yes it's key to separate both, but regardless they know DNS queries + can see all http traffic and TLS handshakes will reveal (in plaintext) the name of sites connected to. So basically... they know very well where you go, they just don't always know (sometimes they do) what is being transferred there.