David Bombal

Does Encrypted DNS Keep Your Traffic Private?

The video tests the popular claim that using DNS‑over‑HTTPS (DoH) together with HTTPS makes all of your internet traffic private, eliminating the need for a VPN. The presenter sets up two PCs, taps the network traffic, and captures packets with Wireshark to see exactly what leaves the browser. By configuring Firefox for strict privacy and routing DNS queries through Cloudflare’s DoH, the DNS lookups are indeed encrypted and invisible to the observer. However, the TLS handshake still leaks the Server Name Indication (SNI) and client‑hello data, which reveal the destination host (e.g., Nvidia, Microsoft) even though the payload remains encrypted. The demonstrator calls out the “always private” mantra, showing that while DNS queries disappear, the SNI field in the clear‑text handshake betrays the sites visited. This concrete example counters the notion that DoH alone provides end‑to‑end privacy. The takeaway is that DoH improves privacy but does not replace a VPN for full anonymity. Users should verify privacy claims with their own packet captures and consider layered defenses when sensitive browsing is required.