Cool but ISP and others can still spy on IPs you make requests to and simply ask for reverse DNS of that IP to still get a good idea of what you are doing? Not sure how we could really achieve 100% privacy from the ISPs.
This has evolved into the universal compromise, since the VPN provider still gets to claim that they themselves aren't doing any logging. But of course their upstream ISP is now easily able to do so.
This is why mullvad intercepts all DNS queries (even to 8.8.8.8 or 1.1.1.1). Try using OpenNIC from behind mullvad: you won't get the extra TLDs.
Logging DNS makes it easy to selectively deanonymize people. All you have to do is get them to browse to a website that resolves a weird domain name.
First, read this: https://en.m.wikipedia.org/wiki/EDNS_Client_Subnet
And this: https://tools.ietf.org/html/draft-hardie-privsec-metadata-in...
Then, start a VPN provider and wait for the NSL to arrive, like Mozilla did.
Not a coincidence that they suddenly started pushing DoH hard shortly after launching their own VPN. Before that it was just another protocol; after the VPN they suddenly were in a big huge hurry to put people on DoH by default whether the system resolver supported it or not.
For the rest, encrypted SNI might help, but it's still a draft so not really in use. Also 95%+ of sites are identifiable by IP only.
If your VPN provider claims they "don't log" it just means they're tagging the query with your IP as it leaves their network and letting their upstream ISP do the logging.
Never, ever, send UDP/53 traffic into a VPN.
DNS setup is messy.
these days, this will be mostly some *.amazonws.com domain.