The "HTTPS" Illusion
You see the lock icon in your browser. You know your connection to https://www.bankofamerica.com is encrypted. Your ISP (Internet Service Provider) cannot see your password or your bank balance.
But they know you are at the bank.
Why? Because before your computer could connect to the bank, it had to ask a DNS server: "What is the IP address of bankofamerica.com?" DNS — the Domain Name System — is the internet's phone book: it translates human-readable names into IP addresses that computers can route to.
Historically, this DNS query was sent via UDP Port 53 in plain text. No encryption. No authentication. Anyone listening on the wire — your ISP, the coffee shop hacker, a government surveillance system — can see exactly which websites you are visiting, even if they cannot see the content of those visits.
This is not a theoretical risk. ISPs in the United States have been legally permitted to sell DNS query logs to advertisers since 2017. Coffee shop Wi-Fi operators routinely log DNS traffic. Nation-state actors use DNS surveillance as a primary censorship and monitoring tool.
Encrypted DNS solves this by wrapping that lookup in encryption, closing the last major privacy leak on the modern web.