I do the same, but I read that that is also sending your IP all around the inter...

jlgaddis · on Oct 25, 2020

What, exactly, does "sending your IP all around the internet" even mean?

minerjoe · on Oct 25, 2020

Meaning, if you don't want people to know you are searching for snm.donkeyporn.com than going out to the nameserver that donkeyporn is using is not exactly keeping the information private.

viraptor · on Oct 25, 2020

In practice with 1.1.1.1 you're trading the parties who know about your access from:

Donkeyporn's DNS provider, com's DNS provider (0.1% chance it's not already cached), your ISP, transit providers, donkeyporn's ISP, donkeyporn service

To: cloudflare, your ISP, transit providers, donkeyporn's ISP, donkeyporn service

It's not a huge change and it's really about whether you trust CloudFlare more than the service donkeyporn has chosen.

minerjoe · on Oct 25, 2020

I though correctly switching to cloudflare should just be me -> cloudflare via an encrypted channel?

viraptor · on Oct 25, 2020

If you're talking about clouflare warp, then yes... kind of. If you mean only the DNS, them no, there are still many connections matching you to the destination.

_-___________-_ · on Oct 26, 2020

Worth noting that until Encrypted SNI is universally used, you probably transmit snm.donkeyporn.com in the clear when your browser does the initial TLS exchange anyway.

I personally feel that concentrating all the information of "what DNS names are people looking up" into the hands of a few parties (e.g. CloudFlare) makes it much easier to collect and analyze this information.

Arnavion · on Oct 25, 2020

You are correct that if you run your own resolver, then all the DNS traffic from your resolver to other nameservers is in cleartext. DoH and DoT only get used by forwarders.