You Still Have to Trust Someone
Encrypted DNS protects you from your ISP. They can no longer log your DNS queries, sell your browsing history to advertisers, or inject ads into DNS responses. This is a genuine and significant privacy improvement.
However, the DNS query still has to go somewhere.
You are not resolving DNS yourself. You are sending those encrypted queries to a centralized provider — Cloudflare (1.1.1.1), Google (8.8.8.8), or NextDNS. These providers can see every domain you query, associated with your IP address.
The Trade-off:
| Scenario | Who Sees Your DNS Queries |
|---|---|
| Traditional DNS (ISP resolver) | Your ISP |
| DoH/DoT to Cloudflare | Cloudflare |
| DoH/DoT to Google | |
| Self-hosted recursive resolver | Nobody (but complex to run) |
| DoH/DoT to NextDNS | NextDNS |
The shift from ISP surveillance to big-tech surveillance is not obviously better from a privacy standpoint — it is a different threat model. ISPs are regulated utilities with legal obligations. Cloudflare and Google are advertising-adjacent technology companies, though both publish audited privacy policies for their DNS services.
The centralization concern goes deeper. When Firefox enabled DoH by default and pointed all US users to Cloudflare, a significant fraction of the internet's DNS traffic suddenly flowed through a single company's infrastructure. This creates a single point of failure and a single point of surveillance. The Internet Architecture Board (IAB) published a formal statement of concern about this centralization effect.
Mitigations:
- Oblivious DoH (ODoH): A newer protocol (RFC 9230) that routes queries through a proxy so the resolver never sees the client's IP address. The proxy sees the IP but not the query content; the resolver sees the query but not the IP. Neither party has the full picture.
- Self-hosted resolvers: Running your own recursive resolver (e.g., Unbound or Pi-hole with DoT upstream) keeps queries off third-party infrastructure for your local network.