Hacker News Reader

There aren't many intermediaries if you use your ISP's internal resolvers.

And there are intermediaries between Cloudflare/other DoH providers and the respective authoritative nameservers anyway.

But unless they have the private key for CloudFlare certs, they can't snoop in so it doesn't matter if there are intermediaries in between.

The traffic between Clouflare and the authoritative nameservers will be good old 53/udp.

The only thing the snooper won't be sure with is, which Cloudflare client asked for that record.

My ISP is subject to specific regulations for licensed network providers, which Cloudflare isn't.

Thus, Cloudflare is the problematic intermediary.