What Encrypted DNS Actually Hides

You read an article about ISPs selling browsing history, flipped on "Secure DNS" in your browser settings, and felt done — encrypted, protected, invisible. That feeling is only partly earned. Encrypted DNS genuinely hides one specific thing from network observers, and it's worth knowing exactly what that thing is, because it's narrower than the marketing implies.

What encrypted DNS (DoH/DoT) actually hides

Plaintext DNS sends every lookup — "what's the IP for example.com?" — over the network in the clear, readable by your ISP, the coffee-shop Wi-Fi operator, or anyone else on the path. DoH wraps that same query inside an HTTPS connection; DoT wraps it inside a dedicated encrypted TLS connection. Both stop a network observer from reading the lookup itself:

Layer	Plaintext DNS	DoH / DoT	DoH + ECH
DNS query content	Visible	Hidden	Hidden
Destination IP address	Visible	Visible	Visible
SNI (domain in TLS handshake)	Visible	Visible	Hidden
Who can see the query	ISP, any network hop	Only your chosen DNS resolver	Only your chosen DNS resolver

Encrypting the query itself is a genuine win — it's the difference between an ISP logging "user looked up example.com" versus logging nothing. But that's where the protection stops unless a second technology is also in play.

What it doesn't hide — the gap nobody names

After the DNS lookup resolves, your device still opens a direct connection to the destination server's IP address — and that IP address is visible to anyone watching the network, encrypted DNS or not. If the site is hosted on a shared IP (like most CDN-fronted sites), the IP alone doesn't identify exactly which page you loaded, but on a dedicated IP it often does.

The bigger gap is the TLS handshake itself. When your browser connects to a server over HTTPS, the very first message — the ClientHello — has historically included the domain name in plaintext, in a field called SNI (Server Name Indication), so the server knows which site's certificate to present. That means even with fully encrypted DNS, a network observer watching the TLS handshake can often read the domain name directly out of that first packet. Encrypted Client Hello (ECH) is the newer standard that finally encrypts the SNI field too — but ECH support is still inconsistent across browsers, servers, and networks in 2026, so most connections today still leak the domain name at the TLS layer even when the DNS layer is fully encrypted.

The trust problem: you're just picking who to trust

Turning on DoH to Cloudflare (1.1.1.1) or Google (8.8.8.8) removes your ISP from seeing your DNS queries — but it doesn't remove a single point of observation, it relocates it. Now Cloudflare or Google sees every domain you look up instead. That might be an improvement if you trust their stated no-logging policies more than your ISP's data-selling practices, but it's a trade, not an elimination.

The only way to remove a third-party DNS observer entirely is to not have one — which means resolving DNS queries yourself, directly against the internet's root and authoritative nameservers, instead of forwarding every query to somebody else's resolver. Public resolvers are free, so unlike the free-freeze-vs-paid-monitoring math, this isn't a cost trade-off — it's purely a question of how many companies you're willing to let see every domain your household looks up.

Running your own recursive resolver: Pi-hole + Unbound

I run Unbound as a recursive resolver on my Proxmox homelab, with Pi-hole in front of it for network-wide ad-blocking. The distinction matters: Pi-hole by default still forwards unblocked queries to an upstream resolver of your choice (often a public one) — it's a filter, not a resolver. Unbound replaces that upstream entirely by querying the DNS hierarchy directly, the same way a public resolver does internally, except the results only ever reach my own network. This is the unbound.conf block that puts it in pure recursive mode, with no forwarding upstream at all:

server:
    interface: 127.0.0.1@5335
    do-ip4: yes
    do-udp: yes
    do-tcp: yes
    prefetch: yes
    root-hints: "/var/lib/unbound/root.hints"

Then in Pi-hole's own settings, under DNS, the custom upstream is pointed at that local Unbound instance (127.0.0.1#5335) instead of a public resolver — so every query Pi-hole doesn't block gets resolved recursively, in-house, rather than forwarded to Cloudflare or Google.

After the first day of cache warm-up, most repeat lookups resolve from Unbound's local cache in single-digit milliseconds, and the queries that do hit the root/authoritative chain land in the 100–200ms range — noticeably slower than a public resolver's edge cache on a cold lookup, but nobody sees the query except my own resolver.

Is it worth running yourself, or is a public encrypted resolver good enough

For most people, switching to DoH or DoT with a reputable public resolver is a meaningful, low-effort privacy upgrade over plaintext ISP DNS — it's a five-minute setting change with a real benefit. Running your own recursive resolver is the move for people who specifically don't want any single company holding a log of every domain their household looks up, and who are comfortable with the ongoing maintenance that comes with self-hosting — the same trade-off calculus behind running Vaultwarden instead of a cloud password vault, or picking a local-only authenticator app over a synced one.

Either way, the honest takeaway is the same: encrypted DNS narrows what a network observer can see, it doesn't make you invisible, and knowing exactly where the remaining gap is (destination IP, SNI without ECH) matters more than trusting the word "encrypted" to mean everything is covered.

Frequently asked questions

Does encrypted DNS stop my ISP from seeing what sites I visit?

Partially. It hides the DNS lookup itself, but your ISP can still often see the destination IP address you connect to, and — because Encrypted Client Hello isn't universally deployed yet — frequently the domain name in the TLS handshake's SNI field too.

What is the difference between DNS over HTTPS and DNS over TLS?

Both encrypt the same DNS query; they differ in transport. DoT uses a dedicated encrypted connection on port 853, which is easier for a network to block outright. DoH tunnels over standard HTTPS (port 443), blending in with normal web traffic and making selective blocking harder.

Is Cloudflare DNS actually private?

Cloudflare's 1.1.1.1 encrypts your query in transit and publishes a no-logging policy, but using it still means Cloudflare — rather than your ISP — sees every domain you look up. It relocates the point of observation; it doesn't eliminate one.

Should I run my own DNS server at home?

Only if you specifically want to remove any third-party resolver from seeing your household's DNS queries and you're willing to maintain it. A tool like Unbound as a recursive resolver, paired with Pi-hole for ad-blocking, does this — but a public encrypted resolver is a reasonable, lower-effort choice for most people.

What is Encrypted Client Hello (ECH)?

ECH is a newer TLS extension that encrypts the SNI field — the domain name that's otherwise sent in plaintext during the TLS handshake. It closes the remaining gap that encrypted DNS alone leaves open, but as of 2026 support is still inconsistent across browsers, servers, and networks.