Your ISP sells your DNS queries to advertisers — DNS encryption stops them cold

On 9 March 2026, Quad9 enabled DNS over HTTP/3 and DNS over QUIC across its entire global resolver network. That move closes the last gap in the encrypted-DNS stack. By April 2026, the protocol suite — DoH, DoT, DNSCrypt, DoH3, DoQ — makes passive DNS collection by ISPs structurally impossible. Yet the vast majority of ISP-issued routers still ship DNS in plaintext over UDP port 53.

Your broadband provider knows you browse rightmove.co.uk before buying a house, mayoclinic.org before a doctor’s visit, and monzo.com before switching banks. That data gets sold into real-time bidding exchanges, without your explicit consent — often without any consent at all. The good news: there are now four ways to shut off that faucet, and none of them requires advanced networking knowledge.

Why your ISP sees everything

DNS is the phonebook of the internet. Every time you open a site, your device sends a query to a resolver — and by default, that resolver belongs to your ISP, assigned automatically via DHCP from your router. The query goes out unencrypted, on UDP port 53, readable by every hop between your device and the resolver.

Your ISP logs three things: your source IP, the domain requested, and a timestamp. Those logs typically sit around for months, sometimes years depending on jurisdiction. In the United States, Congress repealed the FCC’s broadband privacy rules in 2017, removing the opt-in requirement that had been the only meaningful barrier to monetization. In the European Union, ePrivacy and GDPR impose tighter restrictions on paper, but carriers routinely exploit the legal grey zone around “legitimate interest” to funnel DNS metadata into their ad-revenue pipeline.

The result is a browsing profile of startling granularity — domains visited, time of day, geolocation cross-referenced against cell-tower data — sold to programmatic ad platforms. DNS encryption kills that pipeline at the source.

DoH, DoT, and DoQ: the three protocols that lock port 53 shut

Encrypted DNS today rests on three mature protocols, each with a distinct role in the ecosystem.

DNS over HTTPS — DoH (RFC 8484). DNS queries ride inside standard HTTPS on port 443. This is the hardest protocol for an ISP to block, because it’s indistinguishable from regular web traffic. Firefox, Chrome, and Edge have baked DoH in natively since 2020–2021; Android supports it without any third-party app. Its main weakness: an ISP can push its own resolver via the use-application-dns.net DHCP option, and some carriers in the US and Europe already do exactly that.

DNS over TLS — DoT (RFC 7858). Queries travel over a dedicated TLS connection on port 853. Easier to block than DoH because the port is identifiable, but lighter on network overhead. It’s the default transport for Android’s Private DNS, for iOS since version 14, and for most recent consumer routers. Quad9, Cloudflare, Google, and NextDNS all serve DoT endpoints.

DNS over QUIC — DoQ (RFC 9250). The heir apparent, deployed by Quad9 in March 2026. QUIC mandates TLS 1.3, merges connection setup and the encrypted handshake into a single round trip, and survives network changes without renegotiation overhead. Measurably faster than DoT and harder to fingerprint than DoH — but still in the early adoption phase on the client side. This is the protocol to target if you’re deploying today.

A note on DNSCrypt: it’s still maintained and Quad9 runs it, but it was never standardized by the IETF. Useful legacy gear remains, but it’s not a deployment target for 2026.

Quad9, NextDNS, Cloudflare: who actually protects your privacy

Not all encrypted resolvers are created equal. The difference comes down to one question: what does the resolver do with the metadata it sees?

Quad9 — a Swiss nonprofit foundation — stores no personally identifiable information. No IP addresses, no query logs, no data resale. The business model runs on grants (Global Cyber Alliance, IBM, CleanDNS) and donations. Malware filtering is on by default (9.9.9.9) and draws from 22 threat-intelligence feeds. DNSSEC validation is enforced on every endpoint. Addresses: 9.9.9.9 (IPv4), 2620:fe::fe (IPv6), DoH at https://dns.quad9.net/dns-query, DoT at tls://dns.quad9.net.

NextDNS — a commercial company built by the engineers behind Netflix’s network stack — operates a “cloud Pi-hole” with 132 points of presence and a granular configuration dashboard. The privacy policy explicitly forbids data sharing or resale. Users control their own logging: from zero (no-logs mode) up to two years of retention, with jurisdiction choice (US, EU, UK, Switzerland). Blocking covers trackers, malware, cryptojackers, and DGA domains. For a household that wants ad-blocking plus privacy, this is the best balance of control and simplicity.

Cloudflare (1.1.1.1) encrypts queries and purges logs within 24 hours, but its business model — a CDN that sees a material fraction of the world’s traffic — creates a data-concentration issue that worries privacy advocates. Their historical research-data agreement with APNIC is documented and contractual, not a scandal, but it’s a reminder that Cloudflare isn’t a philanthropic foundation.

Google (8.8.8.8) is the worst choice for privacy: DNS resolution data gets cross-referenced with the rest of the Google ecosystem — account, browsing history, ad profile — and the privacy policy maintains carefully calibrated ambiguity about internal data uses.

Encrypting DNS in ten minutes

Three configurations that cover the common use cases, from simplest to most flexible.

Android and iOS: native Private DNS

On Android 9+: Settings → Connections → More connection settings → Private DNS. Enter dns.quad9.net and toggle it on. The OS switches to DoT automatically. On iOS 14+: install a configuration profile via a tool like dns.notjakob.com or use the NextDNS app.

Router: whole-home switch

If your router supports native DoT (recent Fritz!Box, OpenWrt, pfSense, OPNsense), set dns.quad9.net as the DoT resolver on port 853. Every device on the network gets encryption with zero individual setup.

# Unbound config snippet for OpenWrt / pfSense
server:
  forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 9.9.9.9@853#dns.quad9.net
    forward-addr: 149.112.112.112@853#dns.quad9.net

For routers without native DoT, DoH rides over port 443 and blends with regular HTTPS traffic — carriers find it much harder to block.

NextDNS + Pi-hole: the advanced setup

Pairing NextDNS as an encrypted upstream with Pi-hole as a local cache and ad blocker gives you the finest-grained control:

1. Deploy Pi-hole on a Raspberry Pi or a Docker container.
2. In the Pi-hole UI under Settings → DNS, uncheck all plaintext public upstreams.
3. Check Custom 1 (IPv4) and enter your NextDNS DoH address (visible in your my.nextdns.io dashboard).
4. Enable DNSSEC to prevent cache poisoning.

# Pi-hole + NextDNS via cloudflared (DoH → classic DNS proxy)
docker run -d --name cloudflared \
  --restart unless-stopped \
  cloudflare/cloudflared:latest \
  proxy-dns --address 0.0.0.0 --port 5053 \
  --upstream https://dns.nextdns.io/abc123

The path becomes: device → Pi-hole (ad blocking) → cloudflared (DoH tunnel) → NextDNS (resolution). Every hop is under your control.

What DNSSEC actually does

DNS encryption protects confidentiality of your queries. DNSSEC protects integrity: it prevents an attacker from injecting a forged response that redirects monzo.com to a phishing server. The two are complementary, not redundant.

Without DNSSEC, an attacker on the same coffee-shop Wi-Fi can poison your resolver’s cache and send you to a fake banking site even with DoH enabled — because DoH encrypts the query to the resolver but never checks whether the answer is authentic. DNSSEC cryptographically validates the chain of trust from the root zone down to the queried domain. Quad9 and NextDNS enable it by default; Cloudflare does too, but Quad9 actively blocks domains whose DNSSEC signature fails validation.

On Pi-hole, it’s a single toggle under Settings → DNS → Use DNSSEC. On a local Unbound server, add auto-trust-anchor-file and configure the root trust anchor.

The verdict: which resolver for which use case

DNS encryption is now a de facto standard in 2026 — Firefox, Chrome, Edge, Android, iOS, and most recent routers support it natively. Sending DNS traffic in plaintext today is a default choice, not a technical constraint.

For individuals who want zero-config protection: Quad9 at dns.quad9.net via Android/iOS Private DNS. Free, DNSSEC on, malware blocking active, zero logs. Best protection-to-simplicity ratio on the market.

For a household that also wants ad and tracker blocking: NextDNS as DoH/DoT upstream, optionally paired with Pi-hole for local caching. The free tier covers 300,000 queries per month — more than enough for a family. The blocklist configuration interface is the best in class.

For a homelab operator who wants full sovereignty: Unbound as a local recursive resolver, forwarding via DoT to Quad9 for external resolution, with strict DNSSEC validation. Zero dependency on any third party, zero external logs.

For a business: NextDNS or Control D on a paid plan, with per-department configuration profiles (HR, marketing, R&D), category-based content filtering, and per-jurisdiction log isolation. Marginal cost is roughly $2 per seat per month, against a median data-breach cost that exceeded $4.88 million in IBM/Ponemon’s 2025 report.

References

• Quad9 Service Addresses & Features — DoH, DoT, DoH3, DoQ, DNSCrypt endpoint configuration
• Quad9 Enables DNS Over HTTP/3 and DNS Over QUIC — 9 March 2026 announcement
• dnsprivacy.org — Public Resolvers — maintained list of DoT, DoH, and DoQ-capable resolvers
• NextDNS Privacy Policy — no-resale commitment and WYSIWWH mechanism
• RFC 8484 — DNS Queries over HTTPS (DoH)
• RFC 7858 — Specification for DNS over Transport Layer Security (DoT)
• RFC 9250 — DNS over Dedicated QUIC Connections
• Cloudflare — Encrypted Client Hello — ECH, the final privacy puzzle piece