Encrypted DNS is useful, but it is not invisible.
David Bombal's latest demonstration is a good reminder that privacy tools have limits. Pi-hole, Unbound, Cloudflare DNS, Quad9 and browser "Secure DNS" settings can help hide DNS lookups, but they do not automatically stop an ISP or network observer from seeing the websites you connect to.
The weak point is SNI (Server Name Indication). It is part of the early TLS/HTTPS handshake, and unless Encrypted Client Hello is properly supported, it can still reveal the domain you are visiting.
This matters because many people assume that encrypted DNS means private browsing. It does not. It protects one layer. It does not hide everything.
The lesson is not "don't use privacy tools." The lesson is to understand what each tool does, what it does not do, and where metadata still leaks.
What do you use beyond DNS privacy?
https://www.youtube.com/watch?v=H-tPCwxdxpY
#Privacy #EncryptedDNS #SelfHosting #CyberSecurity #SNI #DNS #DigitalFreedom #SelfSovereignty
beitmenotyou1 / Michael J Burgess
npub123…58dpt
2026-05-23 21:14:03 UTC
Author Public Key
npub123j6zd6p5dls3qf2cae3dzqtrgl9vpd942jq6ge8l6mwr7muyy8qv58dptSeen on
wss://relay.nos.socialPublished at
2026-05-23 21:14:03 UTCEvent JSON
{
"id": "1f62a61ec058935185aed453bdae70d570ca898195f604c95fcbbe76432b3a84",
"pubkey": "5465a13741a37f08812ac77316880b1a3e5605a5aaa40d2327feb6e1fb7c210e",
"created_at": 1779570843,
"kind": 1,
"tags": [
[
"t",
"Privacy"
],
[
"t",
"EncryptedDNS"
],
[
"t",
"SelfHosting"
],
[
"t",
"CyberSecurity"
],
[
"t",
"SNI"
],
[
"t",
"DNS"
],
[
"t",
"DigitalFreedom"
],
[
"t",
"SelfSovereignty"
],
[
"client",
"Primal Web"
]
],
"content": "Encrypted DNS is useful, but it is not invisible.\n\nDavid Bombal's latest demonstration is a good reminder that privacy tools have limits. Pi-hole, Unbound, Cloudflare DNS, Quad9 and browser \"Secure DNS\" settings can help hide DNS lookups, but they do not automatically stop an ISP or network observer from seeing the websites you connect to.\n\nThe weak point is SNI (Server Name Indication). It is part of the early TLS/HTTPS handshake, and unless Encrypted Client Hello is properly supported, it can still reveal the domain you are visiting.\n\nThis matters because many people assume that encrypted DNS means private browsing. It does not. It protects one layer. It does not hide everything.\n\nThe lesson is not \"don't use privacy tools.\" The lesson is to understand what each tool does, what it does not do, and where metadata still leaks.\n\nWhat do you use beyond DNS privacy?\nhttps://www.youtube.com/watch?v=H-tPCwxdxpY\n\n#Privacy #EncryptedDNS #SelfHosting #CyberSecurity #SNI #DNS #DigitalFreedom #SelfSovereignty",
"sig": "47dab795e8f22b68531643ac85a500a4fad7c53ba12bf40c05085293e36d236c194bd8d534cdda7534940f609a16287d2e93784988c5ba31e5f5453611c720d6"
}