Hacker News Reader

if the traffic is encrypted how can you tell whether it's http or plain dns?

Because the purpose of middle boxes is to log your traffic no matter what, usually by installing a root certificate on your devices.