DNS was never built to be private.
Here's what encrypting it actually changes.
A plain-language distillation of the Internet Society's Encrypted DNS Factsheet — what DoT, DoH, and DoQ do differently, why encryption alone doesn't guarantee privacy, and why the "encrypt it all" vs. "my network, my rules" debate doesn't have a clean winner.
The directory the entire internet runs on.
The domain name system (DNS) is a directory lookup: it translates human-friendly names like bloqr.dev into the numeric IP addresses machines actually use to connect. Beyond convenience, DNS is what lets a service run across many servers instead of one — pointing an app to whichever server is closest to the user, which is how most cloud services stay fast and resilient.
DNS was standardized in 1983, and its core mechanics have barely changed since. Its privacy properties haven't either: DNS queries are sent unencrypted by default, which means anyone positioned along the network path — your ISP, a public Wi-Fi operator, anyone snooping the wire — can read the name of every site and domain you look up.
A typical DNS lookup. The recursive resolver sees every query it handles — and unless the transport is encrypted, so does anyone else on the path.
Using DNS means trusting a resolver — whether you know it or not.
Every device implicitly trusts its DNS resolver in three ways: to be available and accurate (or you don't reach the sites you meant to), to read every query it's sent (that's how resolution works), and — where traffic is unencrypted — to not expose that data to whoever else happens to be on the path.
Programs like Mozilla's Trusted Recursive Resolver (TRR) try to close part of this gap with published commitments on data retention, transparency, and blocking policy — providers including Cloudflare, Comcast, NextDNS, CIRA, and Shaw have signed on. But a policy commitment is a promise, not a technical guarantee, and it does nothing about the bigger issue: third parties observing DNS traffic on the wire. That requires encryption.
Three ways the IETF has standardized encrypted DNS.
Encryption is the fix for the confidentiality half of the problem: wrap the query so observers on the path can't read it. The IETF has standardized three transport protocols for this:
- DoT — DNS over TLS. Opens a dedicated TLS channel to the resolver and sends queries over it. Encrypts the traffic, but a network observer can still tell it's DNS.
- DoH — DNS over HTTPS. Maps DNS queries onto ordinary HTTPS request/response traffic, so they're indistinguishable from any other web request on the wire.
- DoQ — DNS over QUIC. The same masking idea as DoH, built on the newer QUIC transport instead of classic HTTPS.
Why disguise DNS traffic as ordinary web traffic at all? Because when DNS queries can be singled out, they can be interfered with — for censorship, filtering, or blocking. Masking the traffic makes that kind of selective interference harder.
Encryption hides the query from the network. It doesn't hide it from the resolver.
This is the part most explainers skip. DoT, DoH, and DoQ all protect a query in transit — but the resolver at the other end still has to decrypt and read it to answer. So the resolver still sees the domain, your IP address, and the timing of every lookup, encryption or not. Confidentiality on the wire is not the same thing as privacy from the resolver itself.
Oblivious DoH (ODoH) is the IETF's answer to that specific gap. It routes your encrypted query through a proxy that can see your IP address but not the query contents, on to a resolver that can see the query but not your IP. Your identity and your request are never visible to the same party at the same time.
ODoH splits "who's asking" from "what's being asked" across two separate parties, per RFC 9230.
Even with ODoH, DNS is not the whole picture. Regardless of encryption, an ISP can often still infer which sites you're connecting to from unencrypted parts of the surrounding HTTPS handshake — the TLS Server Name Indication (SNI), OCSP certificate checks, and raw IP addresses. And metadata — timing, request patterns, who you're connected to — remains a rich signal on its own. Encrypted DNS narrows one specific leak; it isn't a privacy panacea.
"Encrypt it all" vs. "my network, my rules."
Not everyone wants DNS traffic encrypted, and the disagreement is legitimate on both sides.
- For encryption: unencrypted DNS is a standing surveillance and censorship vector, and the status quo already concentrates trust in a small number of unencrypted resolvers with no user visibility into what they do with query data.
- Against blanket encryption: only a handful of providers currently offer encrypted resolvers, so widespread adoption risks further centralizing DNS around a few large operators — attractive targets for both attackers and overreach. Network operators and enterprises also rely on visibility into DNS traffic for parental controls, malware detection, troubleshooting, and compliance — needs that encrypted-by-default DNS can quietly break, especially with BYOD devices on regulated networks.
The IETF's ADD (Adaptive DNS Discovery) working group exists specifically to reconcile these — supporting both encrypted and unencrypted resolvers depending on network context, rather than forcing one answer everywhere.
What this means in practice.
- DNS is critical infrastructure. Wrong or unavailable resolution breaks the internet's usefulness outright — any privacy fix has to preserve accuracy and availability.
- Most users have limited agency. Few people know their DNS resolver can be changed, let alone how, particularly on mobile devices and apps rather than browsers.
- The choice of resolver is the real decision. Encrypting the transport only matters if the resolver on the other end is one you'd actually trust with a log of everywhere you go.
- This is a multistakeholder problem. Users, resolver operators, enterprises, and policymakers all have legitimate — and sometimes conflicting — stakes in how DNS confidentiality gets deployed.
This is our distillation, not our research.
This whitepaper is a themed summary of the Internet Society's "Encrypted DNS Factsheet" (May 2023), reproduced and adapted under itsCC BY-NC-SA 4.0license. Bloqr didn't author the underlying analysis — we're presenting it here because it's the clearest public explanation of what encrypted DNS transports (DoT, DoH, DoQ, ODoH) actually do and don't solve, and it directly informs why Bloqr treats resolver choice, not just transport encryption, as the real privacy decision.
Read the original factsheet on internetsociety.org →
Download the source PDF →
Encrypted transport is table stakes. Trustworthy resolution is the point.
Bloqr keeps the filter lists behind your DNS current across every provider you use — no extension, no client software, no manual syncing.