The DNS Privacy Problem

Every time you visit a website, your device performs a DNS lookup — asking a server to translate a domain name like reddit.com into an IP address. By default, this request travels across the internet completely unencrypted. Your Internet Service Provider (ISP) sits between you and the internet, and they can see every single one of these queries in real time.

This means your ISP effectively has a detailed log of every website you intend to visit, even if you use HTTPS and your actual browsing is encrypted.

What Can an ISP Actually See?

Through DNS logging alone, an ISP can build a surprisingly detailed picture of your habits:

  • Which news sites you read and how often
  • Whether you visit health, financial, or legal information sites
  • Which social media platforms you use
  • The general times of day you're active online
  • Patterns that suggest your political leanings, health concerns, or personal interests

Even without seeing the actual content of pages you visit, DNS metadata is extremely revealing. This type of data is often referred to as metadata surveillance — knowing who you talk to (or visit), not what you say.

Do ISPs Actually Log This Data?

In many countries, ISPs are legally required to retain DNS logs and other metadata for a set period. In others, they do so voluntarily for business purposes. This data has value: it can be used for:

  • Advertising profiles: Sold to data brokers or used for targeted advertising.
  • Legal compliance: Turned over to governments upon request.
  • Network management: Throttling certain services or platforms.
  • Regulatory requirements: Many jurisdictions mandate data retention.

The specifics vary by country and ISP, but the general principle holds: assume your plain-text DNS traffic is being logged.

DNS Hijacking: A Bigger Threat

Beyond passive logging, some ISPs actively intercept or hijack DNS requests. Common examples include:

  • NXDOMAIN hijacking: Instead of returning an error when a domain doesn't exist, the ISP redirects you to a search page covered in ads.
  • Transparent DNS proxying: The ISP silently intercepts DNS traffic meant for other resolvers (like 8.8.8.8) and handles it themselves.
  • Censorship: In some countries, ISPs are required to block certain domains via DNS manipulation.

How to Protect Yourself

1. Switch to a Privacy-Focused DNS Resolver

Changing from your ISP's default DNS to a third-party resolver like Cloudflare (1.1.1.1) or Quad9 (9.9.9.9) removes your ISP from the picture — though you're now trusting that resolver instead. Choose one with a clear, audited no-logging policy.

2. Enable Encrypted DNS (DoH or DoT)

Even with a third-party resolver, plain-text DNS is still visible to your ISP in transit. Use DNS-over-HTTPS or DNS-over-TLS to encrypt your queries so your ISP can't read them, even if they intercept the traffic.

3. Use a VPN

A VPN encrypts all your internet traffic, including DNS queries. Your ISP only sees encrypted data going to your VPN server. However, you're shifting trust to the VPN provider — ensure you choose one with a verified no-logs policy.

4. Use Tor

For the highest level of anonymity, Tor routes your traffic through multiple nodes, and DNS resolution happens at the exit node rather than from your device. This is slower but provides strong anonymity.

The Bottom Line

Your ISP has significant visibility into your browsing habits through unencrypted DNS — and in many jurisdictions, they're either logging it or legally compelled to do so. The good news is that protecting yourself is straightforward: switch to an encrypted DNS resolver, and consider pairing it with a VPN for comprehensive protection. Privacy isn't about having something to hide — it's about maintaining control over your personal information.