DNS is the part of the internet nobody encrypts by default. Every site you visit starts with a lookup, and that lookup travels in plaintext — visible to your ISP, your router, and anyone on the same Wi-Fi. It is a readable map of everything you do online. The good news: fixing it takes ten minutes.

See what the network sees

Your machine resolves through whatever the network tells it to. That is the problem in one sentence. Check where your queries actually go:

# what resolver are you using right now?
resolvectl status | grep -A2 "DNS Servers"
# or, on older systems
cat /etc/resolv.conf

# and what does that resolver see when you browse?
sudo tcpdump -ni any port 53

If the resolver is your router or your ISP, those queries are logged and readable by anyone between you and it. On a coffee shop Wi-Fi, that includes the person at the next table with Wireshark. DNS was designed in 1983, when nobody on the network was an adversary.

What a plaintext query leaks

# every site you visit, as a plaintext log line:
curl -s "https://dns.google/resolve?name=example.com&type=A" | jq .

A DNS log is not the content of your browsing, but it is the table of contents. It survives even when you use HTTPS everywhere, and it is the reason your ISP can build a profile from your traffic without ever breaking encryption.

The fix: encrypt the lookup

Two standards fix this: DoT (DNS over TLS, port 853) and DoH (DNS over HTTPS, port 443). DoT is simpler to reason about, DoH hides in the HTTPS noise. Either beats plaintext. On a modern system with systemd-resolved:

# /etc/systemd/resolved.conf
[Resolve]
DNS=1.1.1.1#cloudflare-dns.com 9.9.9.9#dns.quad9.net
DNSOverTLS=yes
FallbackDNS=1.1.1.1 9.9.9.9
sudo systemctl restart systemd-resolved
resolvectl status | grep -A2 "DNS Servers"

The queries are now encrypted to the resolver. Your local network sees a TLS connection instead of a list of every site you visit. Pick a resolver whose logging policy you can read, and if you run your own infrastructure, a resolver like Unbound on your own box is the natural end point — your DNS then stops being someone else's data.

DNS encryption does not make you anonymous; the resolver still sees your queries, and the sites you visit still see your IP. What it stops is everyone in between — the ISP, the router, the coffee shop — from turning your browsing history into a plaintext file. That is a meaningful difference, and it costs nothing.