Internet privacy and the limitations of DNS encryption

Internet service providers (ISPs) maintain a privileged position to monitor user activity, even when websites and applications use encryption. While protocols like HTTPS protect the specific content of communications—such as bank passwords or private messages—ISPs can still identify metadata. This includes IP addresses, connection times, traffic volume, and the specific domains or services being accessed.

Traditional DNS queries, which translate domain names into IP addresses, often travel without encryption, allowing providers to see which websites a user is attempting to visit. While technologies such as DNS over HTTPS (DoH), DNS over TLS (DoT), and DNS over QUIC (DoQ) encrypt these queries to prevent third parties from reading them, they do not provide total anonymity. Even with encrypted DNS, an ISP can often infer user patterns by observing the destination IP addresses and the timing of data flows.

Other common privacy tools have specific, limited functions: incognito mode only deletes local browsing history on the device, and while a VPN hides the connection from the ISP, it does not prevent tracking via cookies, trackers, or logged-in accounts.