DNS over HTTPS can increase user privacy by obfuscating web traffic, but it's no silver bullet as DNS resolving services will still see unencrypted requests
Context & Ripple Effects
Cloudflare set the stage with the 2018 launch of its 1.1.1.1 privacy-focused consumer DNS service, and Mozilla then tried to make encrypted DNS the Firefox default — until it backed off in the UK under pressure from ISPs and the government. This Wired piece lands in the middle of that fight with the protocol's core caveat: encrypting DNS queries hides them from network observers, but the resolving service itself still sees every unencrypted lookup.
That caveat matters because DoH doesn't eliminate the trusted middleman — it relocates trust from thousands of ISPs to a handful of large resolvers, which is precisely the problem Cloudflare and Apple later attacked with Oblivious DNS-over-HTTPS, which decouples DNS queries from user identities.
First-order effects
- Users who enable DoH get encrypted DNS traffic but swap one watcher for another: their ISP loses visibility while the chosen resolver — Cloudflare being the prominent consumer option — sees every domain lookup in the clear.
Second-order effects
- ISPs lose a data stream they historically used for analytics and filtering, which is exactly what triggered the regulatory and political pushback that forced Mozilla to shelve default DoH in the UK; expect resolver operators to become the new focal point of privacy scrutiny.
Third-order effects
- The resolver-sees-everything gap points toward protocols that split trust across parties — the direction Oblivious DoH takes — pushing DNS privacy from encrypting the channel to structurally separating who carries the query from who can link it to a user, and concentrating industry power in whichever companies run both layers.
The trend: DNS privacy is evolving from encrypting queries in transit toward decoupling queries from user identity, with each step shifting trust from ISPs to a small set of large resolver operators.