What does DNS reveal about you? A plain-English guide

DNS is the internet's phone book. Your phone knows names like bank.example, but the network moves data between numeric addresses, so before any site, app or notification can load, your phone asks a resolver: "where does this name live?". It happens hundreds of times a day without you noticing.

Each question is tiny. Together they form a surprisingly detailed diary. This guide explains what that diary contains, who can read it, and what actually changes when you turn on encrypted DNS or a VPN.

What your DNS lookups reveal

A lookup contains a name, not a page. It says "health.example", not which article you read on it. That limit matters, and it's still a lot:

The IETF, the body that writes internet standards, puts it bluntly in RFC 9076: your resolver "knows a lot about you".

Who can see a lookup

A lookup makes several hops, and each hop sees something different.

1. The network you're on. Classic DNS travels unencrypted on port 53. Whoever runs the Wi-Fi (a café, a hotel, your employer, the person who owns the router at home) and your internet provider can read every name. Whoever controls a hotspot can also change the answers and send you somewhere else; our guide to evil twin Wi-Fi shows how fake hotspots use that. To see the whole picture on your own connection, try our What your network sees tool.
2. The resolver. By default it's your internet provider's, or whatever the Wi-Fi hands out. It sees every name you look up and the address you ask from. What it keeps, and for how long, is up to whoever runs it.
3. The name servers. The resolver asks the servers responsible for the root, for .example and for bank.example. They see the resolver's address, not yours. Two standards shape how much they learn: query name minimisation (RFC 9156) sends each server only the part of the name it needs, and the client subnet option (RFC 7871) lets some resolvers pass on part of your IP address so sites can pick a nearby server.

What encrypted DNS changes

Three standards encrypt the trip between your phone and the resolver:

With any of them, the Wi-Fi and your provider can no longer read or rewrite the names. Two things don't change:

• The resolver still sees everything. Encryption protects the trip, not the destination. You've moved your trust from the network to whoever runs the resolver.
• The network still sees where you connect. After the lookup, your phone connects to the site's IP address, and most HTTPS connections still announce the site's name in the opening message of TLS (the Server Name Indication). Encrypted Client Hello (RFC 9849) hides that name, but only where both the browser and the site support it.

So encrypted DNS is a real improvement, and on its own it isn't privacy from the network. Android's Private DNS has three modes (Off, Automatic and a hostname you choose), as Google explained when it launched the feature; our guide to Private DNS versus a VPN explains which one to pick.

What a VPN changes

A VPN encrypts everything, not just DNS. The network sees one encrypted connection to the VPN server; the lookups, the IP addresses you connect to and the site names in TLS all travel inside it. A well-built VPN also answers your lookups itself, inside the tunnel, so they never touch the Wi-Fi's or the provider's resolver.

That concentrates everything in one place: the VPN's resolver now sees every name. Whether that's an improvement depends entirely on what the provider keeps, which is why a VPN's logging policy isn't a detail. Ours is written out line by line in what we store and who pays.

What DNS doesn't reveal

To keep this in proportion:

• Not the page or the content. With HTTPS, a lookup for news.example doesn't show which article you read, what you typed or what you bought.
• Not your messages. Apps with end-to-end encryption leak the name of their servers, not what you say.
• Not always your identity. The resolver sees an IP address, not a name. But an address plus a pattern of lookups can be enough to recognize a household.

Incognito mode changes none of this: it only stops your browser from saving history on your own device.

How PryVPN handles DNS

PryVPN's DNS is built around that last point:

• Each PryVPN server runs its own resolver, reachable only inside the tunnel, so your lookups never cross the Wi-Fi in the clear.
• The resolver checks DNSSEC signatures, so forged answers are rejected.
• It answers from memory and doesn't log your queries; only totals with no identifiers are kept.
• Filters are optional and by category (trackers and malware on by default, ads off unless you turn them on). They work because the resolver checks names, never because it records who asked. The DNS filters article has the details.
• The leak test in the app shows which DNS server your phone is really using, and warns you if Android's Private DNS is sending lookups elsewhere.

A five-minute checklist

1. On public or shared Wi-Fi, don't use plain DNS. Turn on Private DNS (Settings › Network & internet › Private DNS) or use a VPN.
2. Pick your resolver on purpose. Look for a published list of what it keeps and for how long.
3. Don't stack settings blindly. If a VPN handles your DNS, a Private DNS hostname can pull lookups out of it and switch off its filters. With a VPN on, "Automatic" is usually right.
4. Check, don't assume. A DNS leak test shows which resolver you're actually using.
5. Keep HTTPS in mind. It protects the content; DNS privacy protects the list of places.

Frequently asked questions

Can the Wi-Fi owner see my DNS lookups in incognito mode?

Yes. Incognito only affects what your browser stores on your phone. The lookups still cross the network the same way.

Does DNS show the exact pages I visit?

No. It shows names such as forum.example, not the address of the page or anything on it. With plain HTTP (rare today), the network could see more, but that's not DNS.

Is DNS over HTTPS enough on its own?

It stops the network from reading and changing your lookups. It doesn't hide which IP addresses you connect to, and most sites still reveal their name in the TLS handshake. It's a good step, not a full solution.

Does a VPN see my DNS?

Its resolver does, if the VPN handles DNS, which it should. That's why the provider's logging policy matters as much as the encryption.

PryVPN's resolver is built so that the answer to "what did you keep?" is short. If you'd like to try it, you can join the beta.

Spotted a mistake? Write to support@pryvpn.com and we'll fix it and update the date.