Can my ISP see what sites I visit with DNS?

The Great DNS Deception: How Your ISP Still Sees Your Browsing, Even with Encryption

The promise of privacy online is often touted alongside the benefits of encrypted DNS. Many believe that by using a secure DNS service, their internet activity remains hidden from prying eyes, including their internet service provider (ISP). While encrypted DNS does offer improved security against DNS spoofing and eavesdropping on your DNS queries themselves, it doesn’t provide the complete online anonymity many assume. The truth is more nuanced, and hinges on a little-known protocol element: Server Name Indication (SNI).

Your ISP already sees the IP addresses of the websites you visit. This is an unavoidable aspect of how the internet works. Every website has a unique IP address, and when you request a webpage, your ISP’s network routes your request to that address. However, an IP address isn’t always human-readable; it’s just a numerical identifier. This is where DNS comes in. The Domain Name System translates human-friendly domain names (like google.com) into their corresponding IP addresses.

Encrypted DNS, such as DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT), scrambles this DNS query, preventing eavesdroppers from directly seeing the websites you’re trying to access. This protects against malicious actors intercepting your DNS requests and potentially redirecting you to fake websites. But here’s the catch: the communication between your browser and the website still needs to reveal the target domain name.

This is where SNI steps in. SNI is a part of the TLS/SSL handshake – the encrypted connection process between your browser and the website. Before the secure connection is established, your browser sends the Server Name Indication, revealing the domain name (e.g., www.example.com) to the server and your ISP. Since the SNI is transmitted before encryption is fully established, your ISP can see it, effectively circumventing the privacy benefits of encrypted DNS in terms of domain name visibility.

Therefore, even with encrypted DNS, your ISP still has a clear picture of which websites you are visiting, albeit indirectly through the SNI information. While they can’t see the contents of your browsing due to encryption, the domain names themselves are revealed. This means they retain significant insight into your online activity.

This understanding is crucial for anyone concerned about online privacy. While encrypted DNS enhances security in various ways, it doesn’t offer complete invisibility from your ISP regarding the websites you access. To achieve a higher degree of privacy, consider using a VPN in conjunction with encrypted DNS. A VPN encrypts all your internet traffic, masking your IP address and making it significantly harder for your ISP (or anyone else) to monitor your browsing habits. The combined use of these technologies provides a stronger defense against online surveillance.

#Browsing #Dns #Isp