What your internet provider sees
Every connection you make passes through your internet provider. The padlock in your browser hides a lot from it, but not everything. In this lesson you’ll find out who answers your lookups, what the padlock really covers, and how to switch on encrypted DNS and prove it’s working.
In this lesson
- Find out which DNS server answers your device, and who runs it
- Understand what HTTPS hides from your provider and what it leaves visible
- Turn on encrypted DNS in your browser or phone and check that it works
You’ll need: a computer for part 1 (it uses one command), and any browser for parts 2 and 3. This lesson builds on Follow a Name to an Address from Course 1, so do that first if DNS is new to you.
The three things your provider can see
Your provider carries your traffic, so it always knows when you’re online, how much data you use and the addresses of the servers you connect to. On top of that, two things decide how much more it sees:
- Your DNS lookups. Before visiting a site, your device asks a DNS server for its address. By default that question goes to your provider’s own DNS server, in plain text, so it’s a list of every site you visit.
- The site name in each connection. Even on HTTPS, your browser normally states the name of the site it wants at the very start of the connection, before the encryption begins, so the right certificate comes back.
What the provider can’t see on an HTTPS site is everything after that: which pages you read, what you search for, what you type and what comes back.
Try it yourself · part 1
Who answers your DNS lookups?
There’s a special name, whoami.akamai.net, whose answer is the address of the DNS server that asked for it. Look it up, and you find out which server really does your lookups.
🪟 Windows
- Open the Command Prompt (press Windows, type
cmd, press Enter) and run:nslookup whoami.akamai.net - The result looks like this:
Server: 192.168.1.1 Address: 192.168.1.1 Name: whoami.akamai.net Address: 198.51.100.53 - Ignore the first Server line: that’s usually just your router passing the question on. The address at the bottom is the DNS server that actually asked.
🍎 Mac
Open Terminal and run:
dig +short whoami.akamai.netIt prints just one address: the DNS server that asked. (nslookup whoami.akamai.net works too; use the address at the bottom.)
🐧 Linux
dig +short whoami.akamai.netIf dig isn’t installed (common on Ubuntu), install it with sudo apt install bind9-dnsutils, or use resolvectl query whoami.akamai.net instead.
- Don’t be surprised if the answer is a long address with colons, like
2001:db8:5:53::7. That just means the DNS server asked over IPv6. It works the same way. - Copy that address into our ASN lookup. It tells you which network the server belongs to.
- If the network is your internet provider, your provider is answering your lookups and can see every site name you ask for. If it’s Google, Cloudflare, Quad9 or similar, you’re already using a public DNS service, and that company sees them instead.
What the padlock covers
HTTPS encrypts the conversation between your browser and the website, so nobody in the middle can read or change it. Your provider, the café’s Wi-Fi and anyone else on the path see scrambled data. What they can still see is the outside of the envelope: which server it’s going to, roughly how big it is, and when.
| Part of a visit to news.example.com/health/my-condition | Can your provider see it on HTTPS? |
|---|---|
| The site’s name: news.example.com | Usually yes, from your DNS lookup and the start of the connection |
| The page: /health/my-condition | No |
| What you type into the site, and what it sends back | No |
| When you visited, and how much data moved | Yes |
Try it yourself · part 2
Read the outside of the envelope
- Open any article on a news site and look at its full address in the address bar. Everything after the first single slash is the private part: on HTTPS, your provider can’t see it.
- Now look at the part before it, the site’s name. That’s the part that travels in your DNS lookup and at the start of the connection.
- Think about a site whose name alone says a lot, like a clinic, a debt charity or a job site. That’s the kind of information plain DNS hands your provider, even when every page is encrypted.
Encrypting your lookups
Encrypted DNS sends your lookups to a DNS service of your choice in an encrypted connection, so your provider can no longer read them. Browsers call it secure DNS or DNS over HTTPS; Android calls it Private DNS. It moves your lookups to the DNS company you pick, so pick one whose privacy policy you’re comfortable with.
Try it yourself · part 3
Turn on encrypted DNS and prove it works
Menus move between versions, so the quickest way in is the search box at the top of your browser’s settings: type secure DNS or DNS over HTTPS.
Chrome or Edge
- Open Settings and search for secure DNS (in Chrome it’s under Privacy and security → Security).
- Turn on Use secure DNS and choose Cloudflare (1.1.1.1) from the list instead of your current provider.
Firefox
- Open Settings → Privacy & Security and scroll to DNS over HTTPS.
- Choose Increased Protection or Max Protection, with Cloudflare as the provider.
🤖 Android
- Open Settings and search for Private DNS.
- Choose Private DNS provider hostname and enter
one.one.one.one.
This covers the whole phone, not just the browser.
🍎 Safari, iPhone and iPad
Safari has no setting of its own: on Apple devices encrypted DNS is set up for the whole system by an app or a configuration profile, such as the free 1.1.1.1 app from Cloudflare. If you’d rather not install anything, do this part in Chrome or Firefox instead.
- Now open one.one.one.one/help, Cloudflare’s check page. Wait for the results.
- Look for Using DNS over HTTPS (DoH): Yes (or DNS over TLS (DoT): Yes on Android). That’s your proof: lookups from this browser now travel encrypted.
- Here’s the part most people miss. Go back to your terminal and run the
whoami.akamai.netlookup from part 1 again. The answer hasn’t changed, because the browser setting only covers the browser. Other apps on the computer still use the normal system DNS.
What’s still visible after all that
Encrypted DNS takes your lookups away from your provider, but it can still see the addresses you connect to, and on many sites the name at the start of the connection. Hiding those as well is what a VPN does, by putting all your traffic in one encrypted tunnel to the VPN company’s server. That moves the view to the VPN company instead, which is the subject of Lesson 5.
Key takeaways
- Your provider always sees when you’re online, how much data you use and which servers you connect to.
- With default settings it also sees every site name you look up, because DNS travels in plain text to its servers.
- HTTPS hides the pages, searches and form contents, but not the site’s name.
- Encrypted DNS moves your lookups to a DNS company you choose; check it with one.one.one.one/help.
- A browser’s secure DNS setting covers that browser only, not the rest of your device.
Check yourself
Three questions. Pick one answer each and you’ll see why.
1. You read an article at clinic.example/conditions/asthma over HTTPS. What can your internet provider normally see?
2. You look up whoami.akamai.net and the answer belongs to your internet provider’s network. What does that tell you?
3. You turned on secure DNS in Chrome, and one.one.one.one/help says Yes. Is every app on your computer now using encrypted DNS?
Want more detail? What Is My ISP and What Can It See? covers your provider in depth, and Your ISP’s DNS Is Spying on Every Website You Visit compares the public DNS services.
This lesson is part of the free course Privacy and VPNs, licensed under CC BY-NC-SA 4.0: you may share and adapt it for non-commercial use, with credit to ExamineIP and a link to the original.