Every time you open a website, your computer asks a question you never see. It translates the domain name you typed into the IP address of the server that hosts the page. The Domain Name System handles this translation, and it does so through a hierarchy: your computer checks its cache first, then contacts a resolver — typically run by your internet provider — which queries the root servers, the top-level domain servers and finally the authoritative name servers for the specific domain. Four or five round trips across the global internet, completed in milliseconds, happening for every domain on every page you load. A modern news site with analytics, advertising and social media embeds might trigger dozens of queries just to render a single article. The infrastructure is invisible by design.

But invisible does not mean private. Traditional DNS operates in unencrypted plaintext. Every query — every domain, every subdomain, every tracking pixel host — passes through your ISP’s resolver in clear text. Your ISP can see which websites you visit, how often and at what times. It can see that you looked up a medical condition, a political candidate or a job listing. It can log this data, sell it or hand it to government agencies on request. The DNS query log is one of the most comprehensive surveillance tools ever built, and almost everyone generates one every day without realising it. ISPs can also use DNS to block: configure the resolver to return a wrong address for a specific domain, and the website effectively vanishes for every customer on that network. DNS blocking requires almost no infrastructure, deploys in minutes and affects every user automatically.

The obvious fix is encryption. DNS over HTTPS wraps queries inside standard HTTPS traffic, making them indistinguishable from regular web browsing. DNS over TLS wraps them in a dedicated encrypted connection. Both blind the ISP. The plaintext phonebook becomes an encrypted conversation. This is a genuine improvement, but it creates a new problem: the ISP can no longer see your queries, but every query now goes to a single DNS provider. You have stopped the ISP from reading your mail, but you have handed the entire log to someone else instead. The question shifts from whether you trust your ISP to which DNS provider you trust, and the answer depends on who sits at the other end of the encrypted tunnel.

Google Public DNS at 8.8.8.8 is the largest resolver in the world, handling trillions of queries per day. It is fast, reliable and free because DNS query data is valuable to a company whose entire business model is understanding what people do online. Cloudflare at 1.1.1.1 deletes query logs within twenty-four hours and commissions independent audits, but it is still a single American corporation subject to US law and US surveillance authorities. Quad9, a Swiss non-profit at 9.9.9.9, blocks known malicious domains, stores no personally identifiable information and operates under Swiss jurisdiction. Mullvad DNS, from the Swedish VPN company known for accepting cash payments by mail, blocks ads and trackers and logs nothing. NextDNS charges a subscription for extensive configuration options — ad blocking, tracker blocking, analytics — aligning incentives through payment rather than data monetisation. Each provider represents a better deal than the ISP default, but they all share one property: they are centralised services operated by third parties. Someone sees the full picture of your DNS activity. The architecture itself requires trust.

The only way to eliminate that trust requirement is to run your own recursive resolver. A recursive resolver does not forward your queries to an upstream provider — it performs the full resolution chain itself, starting from the root servers and working down through the hierarchy. The root servers see that someone asked about a top-level domain. The TLD servers see that someone asked about a specific domain. The authoritative servers see that someone asked for a specific record. But no single entity sees the complete picture. Privacy emerges from the architecture rather than from a promise. No privacy policy can be violated. No business model can change. No court order to a third party can access your query log, because there is no query log held by a third party.

Self-hosting also enables filtering that no commercial provider can offer at scale. When you run your own resolver with Unbound and add Pi-hole as a filtering layer, you maintain blocklists of advertising, tracking and malware domains. Your resolver returns a null answer for any domain on these lists — the ad never loads, the tracker never fires, and this works for every device on your network: phones, laptops, smart televisions, IoT sensors. Google cannot block ads through its public DNS because it would be blocking its own customers. Cloudflare cannot block domains without becoming a de facto enforcement body with legal liability for which domains it chooses to block. When you self-host, you are the editor, and the scale is too small to attract the legal attention that would make editorial decisions costly.

The technical barriers are modest. A recursive resolver runs on a Raspberry Pi or a home server. The initial resolution for a new domain takes slightly longer than it would with Cloudflare, but the cache handles repeat queries instantly. The risk of running an open resolver that becomes a DDoS amplifier is real but easily mitigated by binding the resolver to your local network. The trade-off is time: configuring a recursive resolver with a filtering layer takes an afternoon, and maintaining it takes occasional updates. The alternative — trusting a centralised provider with your entire DNS profile — takes five minutes to configure and never requires maintenance, but it never eliminates the trust requirement either.

DNS occupies a rare position in the internet infrastructure stack. You cannot build your own search index. You cannot build your own browser engine. But you can choose which resolver handles your queries, and you can run your own if you are willing to invest a little time. That is more agency than almost any other layer of the stack provides. The choice is not between trusting your ISP and trusting Cloudflare. It is between trusting someone with your entire DNS profile and trusting no one. The phonebook is old and boring, but it is one of the few parts of the internet where architectural privacy is still within reach.