Lesson 2 of 4 · 6 min
Who sees your DNS lookups
A plain DNS lookup travels unencrypted. Here is exactly who is positioned to read it, and why that matters even on an HTTPS site.
The previous lesson followed a DNS lookup from your Mac to a resolver and back. That trip is not private by default. Cloudflare’s Learning Center is direct about it: “by default, DNS queries and responses are sent in plaintext (via UDP), which means they can be read by networks, ISPs, or anybody able to monitor transmissions. Even if a website uses HTTPS, the DNS query required to navigate to that website is exposed.”
Think of a normal, unencrypted DNS query as being like a postcard sent through the mail: anyone handling the mail may happen to catch a glimpse of the text written on the back side.
Cloudflare Learning Center
Who is positioned to read that postcard
| Who | What they can typically see | Why |
|---|---|---|
| Whoever runs the Wi-Fi or local network (a café, an office, an airport) | The site names your device looks up while connected | A plain DNS query is unencrypted, so anything observing the local network can read it |
| Your internet provider (ISP), if you use its default resolver | Every site name your device looks up, tied to your account | The ISP’s resolver answers the query directly |
| A third-party resolver (e.g. a public DNS service), if you have switched to one | The same lookups, instead of your ISP | Someone always answers the query; changing resolver moves the visibility, it does not remove it |
That last row matters and is often missed: switching away from an ISP’s resolver does not make DNS private, it relocates the visibility. The Electronic Frontier Foundation puts it plainly when discussing DNS-based blocking: “your new DNS provider will obtain the information about your browsing activity that your ISP once had, which can be a privacy concern.” Someone answers every lookup; the question is who, and what they do with that record.
Why a name lookup matters even with HTTPS
HTTPS encrypts the content of a page and the exact path you request on a site, but it does not encrypt the DNS lookup that happens first, to find that site’s address at all. So even on a fully encrypted connection, the sequence of site names your device looked up, and when, is often visible to whoever is watching the network or running the resolver, which is exactly the kind of metadata this university’s introductory course describes: not the content of what you read, but a record of where you went.
scutil --dns
DNS configuration
resolver #1
nameserver[0] : 127.0.2.2
nameserver[1] : 127.0.2.3
...scutil --dns lists the resolver (or resolvers) your Mac currently sends lookups to for each kind of network it is on. It is a useful first check before assuming who can see your lookups: the answer depends entirely on which resolver is configured, and on ISP, Wi-Fi and VPN connections it can change without you noticing.
Key takeaways
- A plain DNS lookup travels unencrypted, so anyone who can observe the network path, the Wi-Fi owner, the ISP, can read it.
- HTTPS encrypts page content and paths, but not the DNS lookup that finds the site’s address in the first place.
- Switching to a different DNS resolver relocates who sees your lookups; it does not make the lookup itself private.
- The record of which sites you looked up, and when, is metadata that can matter even without the content of what you read.
- You can check which resolver your Mac is using with `scutil --dns`.
Check yourself
1. Why can the owner of a café Wi-Fi network typically see which sites you looked up?
- Because they own your device
- Because a plain DNS query travels in plaintext across the local network by default — Right.
- Because HTTPS shares this information with Wi-Fi owners
- They cannot see this under any circumstance
Cloudflare notes DNS queries are sent in plaintext by default, readable by "networks, ISPs, or anybody able to monitor transmissions."
2. Does visiting an HTTPS site hide the DNS lookup that finds its address?
- Yes, HTTPS encrypts the DNS lookup too
- No, the DNS lookup that happens first is exposed even when the site itself uses HTTPS — Right.
- Only for .com domains
- Only if a VPN is also used
Cloudflare states plainly that "even if a website uses HTTPS, the DNS query required to navigate to that website is exposed."
3. If you switch from your ISP’s resolver to a different public DNS resolver, what changes about privacy?
- Your lookups become completely private to everyone
- The visibility moves to the new resolver operator instead of disappearing — Right.
- Nothing changes at all
- Your ISP can no longer see any of your traffic
The EFF notes that a new DNS provider "will obtain the information about your browsing activity that your ISP once had" — the visibility relocates rather than vanishes.
Do it with FireAI
Put this lesson into practice on your own Mac.
- Deep inspection, without decrypting anything — Get real detail on a secure connection without FireAI ever reading what’s inside it.
- Threat lists (opt-in) — Check your traffic against public threat data without sending it anywhere.
- Block an app from the internet, or just one company or domain for it — Cut off exactly what you mean to — the whole app, or just one company it talks to.
Sources
- Cloudflare Learning: DNS over TLS vs. DNS over HTTPS
- EFF Surveillance Self-Defense: Understanding and Circumventing Network Censorship
Put it into practice on your Mac
Try every feature free for 17 days, no card needed.