So I use a private VPS to host my own VPN, rather than pay/trust another company to host it for me. I am an intermittent traveller so it is cheaper for me to spin up or down my server as I choose.
The main reasons I use a VPN are 1. To stay secure in WiFi networks I don't trust 2. Avoid filtering services 3. Avoid DNS logging in countries that now use it.
I do not use it for or care about sophisticated attacks against me or high-level government investigations against me. (I just want to be left out of broad-brush surveillance techniques like DNS logging/snooping)
Since I spin the server up and down as needed, it is a pain to change the IP address in the OpenVPN config files for all my devices each time. As such I have pointed a subdomain I own eg
vpn.mydomain.com (A record) at my VPN server, and all I need to is make sure that it points at the VPS's IP every time I spin it up and I'm good to go.
Since the domain name
vpn.mydomain.com will be resolved by DNS un-encrypted anyone can look at my traffic see that the last DNS request sent was for vpn.mydomain.com and then all they will see is encrypted VPN traffic. All they then need do is look up the IP of
vpn.mydomain.com and look at the DNS traffic of that IP and they will have aa 100% capture of my DNS traffic. completely undoing reason 3?
Is this logic valid? The only solution I can think of is to host the VPN server in a distant country with no snooping, keep manually changing the IP addresses or use some fancy re-direct methods that will probably make auth fail.
Message to mods: I know "Is it a bad idea to use a domain name to access my VPN?" is a very similar question, but it doesn't address this point.