DNS as a diary
Why it matters Before your device loads any site, it asks out loud for that site's address. Those questions form a list of every site you visit, with times. Knowing who can read that list is the first step to deciding who should.
Think of a phone book, or a helpful receptionist you phone to ask for a company's number. You ring up and say "what is the number for ShopB Pharmacy?" The receptionist now knows you called a pharmacy, and when. Do that for every site you visit all day, and the receptionist holds a diary of your life.
DNS: the Domain Name System: the internet's phone book. It turns names like shopb.example into IP addresses that packets can be sent to.
Resolver: the server that answers your DNS questions, the receptionist in our picture. Unless you change it, your device usually uses one run by your internet provider, or whichever network you joined.
One lookup, step by step
- You type
shopb.example. Your device asks its resolver: "what is the address of shopb.example?" - If the resolver does not already know, it asks around the DNS system: first the servers for the ending (
.example), then the server that holds the answers forshopb.example, called the authoritative server. - The resolver passes the answer back, for example
198.51.100.31, and remembers it for a while. That memory is called a cache, and how long it lasts is the answer's TTL (time to live). - Only now does your browser connect to the site.
A real page triggers more than one lookup. A visit to a ShopB product page might ask for shopb.example, metrics.example and adco.example, because the page loads scripts from those sites. So your DNS questions also reveal the trackers on each page.
Who can read the diary
| Who | What they see with ordinary DNS |
|---|---|
| Your local network (home router, café Wi-Fi, an office) | Every question and answer: ordinary DNS is not encrypted |
| Your internet provider | The same, and it usually runs the resolver too |
| The resolver | Every question, with your IP address and the time |
| Authoritative servers | The question, usually from the resolver's address rather than yours. Some resolvers pass along part of your address to get a nearby answer, a feature called EDNS Client Subnet. |
Here is the kind of log a resolver could keep about one household on our practice web:
07:02 203.0.113.7 news.example
07:02 203.0.113.7 adco.example
12:40 203.0.113.7 shopb.example <- a pharmacy
12:40 203.0.113.7 metrics.example
23:15 203.0.113.7 shopc.example <- money-trouble pages live hereNo page content, no cookies, and still a sensitive picture: a pharmacy at lunch, a debt advice site late at night. A list of names and times can say a lot.
Because ordinary DNS is unprotected, a network can also change the answers: some networks use this to block sites, show a sign-in page, or, in the worst case, send you to a fake copy. Encrypted DNS, next lesson, protects against reading and changing on the way.
A common misconception: "private or incognito mode hides my DNS lookups". It does not. Private windows forget history and cookies on your device afterwards; the lookups still go out over the network as usual.
Try it On a computer, open a terminal (Command Prompt on Windows, Terminal on a Mac) and type nslookup example.com. The reply names the server that answered (your resolver) and the address it gave. That server just received one more line of your diary.
Recap
- Every site, and every tracker a page loads, starts with a DNS question.
- Your resolver sees all your questions with your IP address and the time.
- Ordinary DNS is unencrypted, so your network and provider can read it, and change answers.
- Private browsing modes do not hide DNS lookups.
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.