Hacker News Reader

And there are intermediaries between Cloudflare/other DoH providers and the respective authoritative nameservers anyway.

My ISP is subject to specific regulations for licensed network providers, which Cloudflare isn't.

Thus, Cloudflare is the problematic intermediary.

But unless they have the private key for CloudFlare certs, they can't snoop in so it doesn't matter if there are intermediaries in between.

The traffic between Clouflare and the authoritative nameservers will be good old 53/udp.

The only thing the snooper won't be sure with is, which Cloudflare client asked for that record.