"Private DNS" isn't as private as you think

Switching on "private DNS" feels like flipping the privacy switch. The name alone makes it sound like a one-click solution to keep your browsing habits to yourself, hidden from your ISP, your network admin, and anyone else who might be peeking at your traffic.

The reality is messier. Private DNS does plug one specific hole, but it leaves a surprising amount of your activity exposed in ways most people never think about. I've gone down this rabbit hole more than once, and here's where the leaks actually happen .

What "private DNS" actually does (and what it doesn't do)

The name oversells the feature by a wide margin

Private DNS, in most cases, just means your device is using DNS over TLS (DoT) or DNS over HTTPS (DoH) to talk to a resolver like Cloudflare, Google, or Quad9. That encryption stops your ISP or someone on the same Wi-Fi from reading the contents of your DNS lookups in plain text.

That's a real improvement over the old default, where every "what's the IP for example.com?" query traveled in clear text for anyone to inspect. But the marketing language around private DNS makes it sound like a privacy cloak for your whole connection, and it absolutely is not. It only encrypts DNS lookups, not any of the other data your device sends out.

If you flip on "Private DNS" in your Android settings and assume you're now invisible online, you're going to be disappointed. The feature does one narrow job, and a lot of identifying information rides on entirely different rails.

Your ISP can still tell where you're going

IP addresses and SNI metadata give the game away

Here's the part that surprises people. Even with DNS encrypted, your ISP can still see the IP address of every server you connect to. That alone is often enough to figure out which sites or services you're using, especially for major platforms hosted on dedicated infrastructure.

It gets worse. When your browser starts an HTTPS connection, it usually sends the hostname in plain text inside something called Server Name Indication (SNI). That means even when your DNS lookup is encrypted, the very next packet your computer sends often contains the domain name in readable form. Network observers can also infer what you're visiting from connection patterns, timing, and other metadata.

So the ISP can't read your DNS query, but they can watch you connect to a specific IP address and frequently still see the hostname your browser hands over. Private DNS doesn't touch any of that. The conclusion researchers keep landing on is that DoT and DoH improve your privacy situation, but only to a limited extent, and someone watching your traffic can still paint a rough picture of your browsing habits.

You're just trading one observer for another

Your DNS provider sees everything you used to hand to your ISP

When you switch to private DNS, your queries stop going to your ISP's resolver and start going to whoever you picked instead . That's usually Cloudflare, Google, Quad9, or whatever your phone defaults to. Encrypted or not, those queries are still fully visible to the resolver handling them.

That's a real tradeoff. You're betting that your chosen DNS provider has better privacy practices than your ISP, which is often true but not guaranteed. Some providers log queries, some monetize the data, and some are based in jurisdictions with their own rules about what has to be handed over on request. Private DNS only works as a privacy tool if you actually trust the resolver on the other end, and the average user has no idea which provider their device is even using.

There's also the SSL certificate angle to think about. Invalid or sketchy certificates during the TLS handshake can themselves create privacy risks, since the handshake exposes information about who you're connecting to before encryption fully kicks in.

DNS leaks happen even when "private DNS" is on

Other apps, VPNs, and Wi-Fi quirks can route around the setting

This is the leak that catches people off guard. You can have private DNS configured at the system level and still have queries escape through other paths. Some apps use their own hardcoded DNS resolvers and ignore your system settings entirely. Some routers force all DNS traffic to the ISP's servers no matter what your device prefers.

If you use a VPN, you'd think DNS is automatically handled, but a misconfigured VPN can let DNS queries bypass the tunnel and head straight to your ISP's resolver, exposing your real location and browsing activity. That's the classic "DNS leak" scenario, and it happens more often than people realize.

Phones connected to Wi-Fi are especially vulnerable here. The router's default DNS is often whatever the ISP provided, and depending on how aggressively the network captures DNS traffic, your encrypted queries may not actually leave the network the way you expect. The fix usually involves running a DNS leak test from a tool that checks where your queries are really going, rather than trusting that the toggle in your settings is doing its job.

Private DNS is worth using, just don't oversell it to yourself

Treat it as one layer, not a full solution

I don't want to leave the impression that private DNS is pointless. It absolutely beats sending every lookup in plain text, and it stops the laziest form of network-level snooping in its tracks. For people who don't run a VPN, switching to a trustworthy DoT or DoH provider is one of the easiest privacy wins available.

The trick is not mistaking it for something it isn't. Privacy online is layered, and no single tool covers everything. If your goal is to actually hide your browsing from your ISP, you need to think about IP-level traffic, SNI, app behavior, and resolver trust at a minimum. That usually means combining private DNS with a VPN, an encrypted SNI-capable browser, and some attention to which apps are doing their own thing behind your back.

---

Private DNS is a start, not a finish line

The label "private DNS" sounds airtight, but the feature only encrypts a thin slice of what your device tells the outside world. Your ISP can still profile you through IP addresses and SNI, your DNS provider sees every query you make, and various apps and network configurations can quietly bypass the whole thing.

If you've been treating that toggle as your privacy strategy, it's worth knowing what it actually covers. Use it, sure, but pair it with the rest of the stack if you genuinely care about who's watching. Anything less is more about peace of mind than real privacy.