3 ms·

Without DNS encryption, my ISP gets a complete log of every hostname I query. With DNS encryption, your ISP still gets a complete log of every IP you visit. An

Without DNS encryption, my ISP gets a complete log of every hostname I query. With DNS encryption, your ISP still gets a complete log of every IP you visit. And from your IP log, they can easily get the host names if they want them. In fact, I'd be surprised if they even bother logging DNS at all. It's much easier, more efficient and just as effective to log IPs. Used by itself, encrypting DNS doesn't really hide anything and is thus an exercise in futility. Used with a more comprehensive solution like a VPN, it is even more so.

voioo 1y ago
Yes, DNS encryption not hiding IP, that part is true. But still not useless is my point. ISP cannot see exact domains, only IP, and with CDN one IP can be many sites. Also DNS hijack/poison is common, and DoT/DoH stop this cheap attack. VPN is stronger, but DNS encryption is small layer of privacy without moving trust to VPN provider.
1vuio0pswjnm7 1y ago
"And from your IP log, they can easily get the host names if they want them." And each IP may have multiple hostnames associated with it, requiring more work to determine which one was accessed by the internet subscriber The VPN also has an IP log for jqpabc If someone wants to explore jqpabc's "sensitive traffic", it's even easier than asking his ISP. Because jqpabc uses a third party VPN, we just subpoena the VPN and they start logging, unbeknownst to jqpabc Because the VPN uses a third party DNS cache that sends EDNS client subnet and does not encrypt DNS traffic to authoritative DNS servers, we can also get logs from those servers as well as jqpabc's general location And of course jqpabc sends plaintext SNI so we have another source of hostnames that he has visited, in addition to plaintext DNS