DNS and DoH: How your ISP is secretly watching (and how to stop it)

When we talk about online privacy, most people immediately think of a VPN or incognito mode. Yet, there is a fundamental part of the internet that is often overlooked, and which may be leaking your entire browsing history: DNS.

What is DNS (Domain Name System)?

Computers don't talk to each other using names like coenraad.eu or google.com, but via IP addresses (like 192.0.2.1). Because it's impossible for humans to remember all those numbers, the Domain Name System was invented. Think of it as the phonebook of the internet.

Every time you type a web address, your device asks a DNS server: "Which IP address belongs to this name?". By default, this question is answered by the DNS server of your Internet Service Provider (ISP) such as Comcast, BT, or Vodafone.

The big problem: Plaintext requests

This is where the privacy problem arises. Classic DNS traffic (via port 53) is unencrypted. It is sent in 'plaintext'. This means that even if you visit a highly secure website (HTTPS), your initial search in the phonebook is visible to anyone listening.

• Your ISP: They can keep an exact log of every website you visit and (depending on local laws) sell or analyze this data.
• Hackers on public networks: Are you on the WiFi in a coffee shop? A hacker on the same network can easily 'eavesdrop' on your DNS requests.
• DNS Spoofing: Because the requests are not secure, malicious actors can intercept the answer and silently redirect you to a fake copy of a website (like your bank).

The Solution: DNS over HTTPS (DoH)

To plug this massive privacy leak, DNS over HTTPS (DoH) was created. DoH takes your DNS request and wraps it in a highly secure, encrypted HTTPS connection. Instead of shouting your request across the street, you are now whispering it in a soundproof tunnel.

To an outsider, including your ISP, the only thing they see is a connection to a DoH server (like Cloudflare or Google). They have no idea which specific websites you are requesting.

How to check this?

On the main dashboard of Coenraad.eu, we perform a real-time check to see which DNS provider is handling your requests. Do you see the name of your local ISP here? Then chances are you are still using unencrypted DNS.

Tip: You can easily enable DoH in your browser settings. Search for 'Secure DNS' in Chrome or Firefox and choose a provider like Cloudflare (1.1.1.1) or Quad9 to immediately reclaim your privacy.