Hacker News Reader

> ISPs can also observer your DNS lookups to Google’s or anyone else’s public DNS servers.

edw, could you elaborate on that, please? I thought changing to public DNS servers like OpenDNS provides some security from ISP tracking.

View on HN

In addition to the lack of encryption mentioned, some ISPs transparently intercept DNS requests and reply to them with their own.

Test your own ISP: try something like

nslookup news.ycombinator.com 1.2.3.4

If you get a response, your ISP is gaslighting you.

Some ISPs even tried to replace NXDOMAIN replies with their own "services". That was particularly popular in the last decade, though I haven't seen any recently.

Traffic between you and the public DNS servers isn't encrypted, so your ISP can still read it.

(I suppose this is one of the problems that DNS-over-HTTPS is designed to fix.)

Thank you for the answer, stuuuuuuuuu! I'll look into it.

...

DNS-over-HTTPS can be enabled in Firefox via Network settings, turns out.

Reply on news.ycombinator.com