Re:Choosing a Public DNS Resolver
by abcdefg12 on Saturday June 27, 2026 @09:22PM
(#48703417)
Or you could use dnscrypt so ISP doesn’t see your lookups at all
[ Parent
| on HN ]
When all the authoritative servers support TLS I can enable TLS outbound but very few of them do at the moment. At some point someone is decrypting, turtles all the way down. I could of course just do DoT to another instance of Unbound somewhere else but I do not need to do that as my ISP does not care about my queries. I used to keep standby DoT Unbound servers around but I have never once seen a US ISP tinker with my traffic. If they did I would put up billboards saying they what they are doing.
There is a bunch of public dnscrypt servers to which your client can randomly fan out encrypted queries.
There are but I will wait until all the authoritative resolvers support TLS. If I wanted to hide my traffic from my ISP then I would just use DoT from my firewall Unbound instance to a few Unbound instances I already have around the web.
« I’ll keep my house door open until there is a really secure lock installed ». You either care about tampering and snooping or you don’t.
I understand your concerns. I personally do not share these concerns though I did when I resided in California that is for sure.
I know just about everyone at my ISP. I know where many of them live. We all live in the same small tight knit community. They tried really hard to get me to join their network team.
Yours is not particularly problematic but I've always wondered how come advertising agencies allow highly controversial topics on their billboards in the US.
I know some (all?) EU advertisers deny creatives based on optics i.e. "our name and logo is on the billboard frame, we don't wanna get associated with topic X".
They like money. Controversial is not illegal. Slander is. If I purchase billboard space and spread defamation that will be problematic. The ISP could always take me to court but they would very likely lose provided I can prove I am telling the truth.
During the TLS handshake, you send the domain name in clear text (Server Name Indication - SNI extension) so that the hoster can present the correct certificate for that domain.
Nothing prevents the ISP from collecting that.
Hence Encrypted Client Hello (https://datatracker.ietf.org/doc/rfc9849/), though deployment is still thin.