--- title: I thought encrypted DNS protected my privacy, until I... description: Encrypted DNS (DoH) hides DNS queries from your ISP, but the TLS handshake's Server Name Indication (SNI) field still exposes the destination hostname in... canonical: https://daily.dev/posts/i-thought-encrypted-dns-protected-my-privacy-until-i-saw-what-my-isp-could-still-see-4hfftneak twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: I thought encrypted DNS protected my privacy, until I saw what my ISP could still see | daily.dev og:description: Encrypted DNS (DoH) hides DNS queries from your ISP, but the TLS handshake's Server Name Indication (SNI) field still exposes the destination hostname in... og:url: https://daily.dev/posts/i-thought-encrypted-dns-protected-my-privacy-until-i-saw-what-my-isp-could-still-see-4hfftneak og:image: https://api.daily.dev/og/posts/4HfFTneak.png og:image:alt: I thought encrypted DNS protected my privacy, until I saw what my ISP could still see og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # I thought encrypted DNS protected my privacy, until I saw what my ISP could still see **[XDA Developers](https://daily.dev/sources/xda-developers)** · 4 min read · 0 upvotes · 0 comments ## Summary Encrypted DNS (DoH) hides DNS queries from your ISP, but the TLS handshake's Server Name Indication (SNI) field still exposes the destination hostname in plaintext. Using Wireshark to capture traffic on port 443, the author confirmed that familiar and background domains were visible despite DoH being active. Encrypted Client Hello (ECH) was designed to fix this by encrypting the SNI field, but adoption remains limited — Cloudflare is the main CDN supporting it at scale. For full privacy, DNS provider, CDN, and the website itself must all support ECH, meaning encrypted DNS alone is insufficient to hide browsing destinations. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Changing your DNS doesn't hide anything, it just copies the list somewhere else](https://daily.dev/posts/changing-your-dns-doesn-t-hide-anything-it-just-copies-the-list-somewhere-else-0uj2i3aib) · XDA Developers · 0 upvotes · 0 comments --- Tags: [#wireshark](https://daily.dev/tags/wireshark) [View this post on daily.dev](https://daily.dev/posts/i-thought-encrypted-dns-protected-my-privacy-until-i-saw-what-my-isp-could-still-see-4hfftneak) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"I thought encrypted DNS protected my privacy, until I saw what my ISP could still see","url":"https://daily.dev/posts/i-thought-encrypted-dns-protected-my-privacy-until-i-saw-what-my-isp-could-still-see-4hfftneak","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/i-thought-encrypted-dns-protected-my-privacy-until-i-saw-what-my-isp-could-still-see-4hfftneak"},"datePublished":"2026-07-25T20:02:01.037Z","dateModified":"2026-07-25T20:02:24.896Z","description":"Encrypted DNS (DoH) hides DNS queries from your ISP, but the TLS handshake's Server Name Indication (SNI) field still exposes the destination hostname in...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a268d69104ab3c54043d698a5bc5cb3a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a268d69104ab3c54043d698a5bc5cb3a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"XDA Developers","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"XDA Developers","logo":"https://media.daily.dev/image/upload/s--kCg6yyAP--/f_auto,q_auto/v1774964407/logos/xda-developers?_a=BAMAMiWQ0","url":"https://daily.dev/sources/xda-developers"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/i-thought-encrypted-dns-protected-my-privacy-until-i-saw-what-my-isp-could-still-see-4hfftneak","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"wireshark","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"XDA Developers","item":"https://daily.dev/sources/xda-developers"},{"@type":"ListItem","position":3,"name":"I thought encrypted DNS protected my privacy, until I saw what my ISP could still see"}]} ```