The Invisible Middleman: How Your DNS Requests Are Being Monetized Before You Even Load a Page

Before your browser loads a single pixel of any website, something happens that most users never see. Your device sends out a small query — essentially asking, "What's the address for this website?" — to a server that translates human-readable domain names into the IP addresses computers use to communicate. This process is called DNS resolution, and it happens dozens or hundreds of times a day on your behalf.

It also happens, by default, in plain text. Unencrypted. Visible to your internet service provider, your router, and anyone else positioned between your device and the internet.

For most of the web's history, this was treated as an acceptable technical trade-off. DNS was infrastructure. Nobody thought much about it. But over the past decade, as behavioral data became one of the most valuable commodities on the planet, that unencrypted trickle of domain queries became something else entirely: a revenue stream.

What Your DNS Traffic Actually Reveals

It's worth being specific about what a DNS query exposes, because "the websites you visit" undersells it.

DNS logs can reveal health-related searches (the domains of medical information sites, telehealth providers, pharmacy chains). They can reveal financial behavior (brokerage platforms, loan sites, bankruptcy resources). They can expose relationship status, political leanings, religious practice, and mental health struggles — all inferred from which domains you query, and when.

You don't have to actually load the page for this data to be captured. The query itself is enough. And because DNS happens before any HTTPS encryption kicks in, the lock icon in your browser's address bar offers zero protection at this layer.

In the United States, the regulatory landscape makes this particularly sharp. A 2017 Congressional resolution eliminated FCC rules that would have required ISPs to get opt-in consent before selling customers' browsing data. Major carriers like Comcast, AT&T, and Verizon have all faced scrutiny over data monetization practices. Your ISP's default DNS resolver isn't a neutral utility — it's a data collection point.

The Ad Network Angle

ISPs aren't the only players here. Ad networks have long recognized DNS as an underutilized tracking surface. Some advertising infrastructure operates its own DNS resolution services, specifically designed to correlate domain queries with advertising profiles. When your device uses a DNS resolver operated by or affiliated with an ad tech company, every lookup contributes to a behavioral model that follows you around the web.

There's also the practice of DNS-based ad injection — where ISPs intercept failed DNS lookups (a mistyped URL, for example) and redirect users to a branded search page full of ads rather than showing a standard error. Comcast ran a program called Domain Helper that did exactly this for years. It was opt-out only, and most customers never knew it existed.

DNS-over-HTTPS: The Fix That's Actually Available Right Now

The good news is that the technical solution to unencrypted DNS has existed for several years and is increasingly practical to use. DNS-over-HTTPS, or DoH, wraps your DNS queries inside encrypted HTTPS traffic — the same protocol that protects your web browsing. This means your ISP (and anyone else watching your connection) sees encrypted traffic rather than a readable list of every domain you visit.

Firefox enabled DoH by default in the US back in 2020, routing queries through Cloudflare's 1.1.1.1 resolver. Chrome and Edge have added DoH support as well, though the implementation varies and isn't always the default.

DoH isn't a silver bullet. You're still trusting whoever operates your DNS resolver — you've just shifted that trust from your ISP to a third party like Cloudflare or Google. Whether that's an improvement depends on your threat model and your level of trust in those companies. Cloudflare has made public commitments about not retaining query logs, and their practices have been independently audited. Google's 8.8.8.8 resolver is fast and reliable, but Google's broader data practices give some privacy advocates pause.

Alternative Resolvers Worth Knowing

If you'd rather not route everything through the two biggest names in tech, there are solid alternatives:

Quad9 (9.9.9.9) is operated by a nonprofit and focuses on both privacy and security, blocking known malicious domains. They don't log personal data and are based in Switzerland under strong privacy law.

NextDNS offers a configurable resolver with detailed logging controls — you can see exactly what's being queried from your devices and set your own blocking rules. There's a free tier that works well for most users.

Running your own resolver is the most technically involved option but gives you maximum control. Tools like Pi-hole (which also blocks ads at the DNS level) or Unbound can be self-hosted on a Raspberry Pi or a cheap VPS. It's not for everyone, but it's genuinely within reach for technically inclined users.

DNS-over-TLS and the Broader Landscape

Alongside DoH, there's DNS-over-TLS (DoT), which encrypts DNS traffic using TLS rather than wrapping it in HTTPS. The practical difference for most users is minimal — both encrypt your queries. DoT uses a dedicated port (853) which makes it easier for network administrators to identify and potentially block, while DoH blends in with regular web traffic on port 443. For users trying to bypass ISP-level interference, DoH tends to be more robust.

There's also the emerging ODOH (Oblivious DNS-over-HTTPS) protocol, which adds an additional proxy layer so that even the resolver you're using can't link your IP address to your queries. It's still early-stage, but it represents the direction the privacy-focused DNS community is pushing toward.

What Your Browser Should Be Doing

Here's where browser design becomes relevant. A browser that treats your privacy as a genuine priority shouldn't leave DNS configuration buried in an advanced settings menu that most users never find. It should surface DoH as a clear, understandable option during setup. It should explain, in plain language, what DNS is and why it matters.

Better yet, it should give users a real choice of resolvers — not just a single default that happens to be a business partner — and make it easy to switch. The browser is the primary interface through which most people experience the internet. If it's not helping users understand and control fundamental protocol-level privacy decisions, it's leaving them exposed in ways they can't see.

Getting Started Today

If you want to improve your DNS privacy right now, here's a practical starting point:

In your browser settings, find the DNS or security section and enable DNS-over-HTTPS. Choose a resolver based on your priorities — Cloudflare for speed, Quad9 for nonprofit accountability, NextDNS for customization.

If you want system-level protection (covering all apps, not just your browser), configure DoH or DoT directly in your operating system's network settings. Windows 11 supports DoH natively. macOS has similar support. On mobile, both Android and iOS allow you to set a private DNS provider.

The web's infrastructure wasn't designed with privacy in mind — it was designed to work. Thirty years later, we're still running on protocols built for a different era, and the gaps have been monetized thoroughly. DNS is one of the most actionable places to start closing those gaps, and the tools to do it are already here.