1

1.1.1.1 might be encrypting the DNS request but then between my ISP and the website I'm accessing, IP addresses are exchanged.Does my ISP see the IP address of the website I'm accessing but not its domain name?

When that happens over HTTPS therefore you the domain is encrypted, is the IP address still leaking? And what about simple HTTP ?

Improve this question

4 Answers 4

Reset to default
2

There are several unrelatd topics here, but:
Yes, the IP never is safe from attackers. Neither is the domain name is your scenario.

First, Cloudflares DNS might support some encrypted transfer, but this won't happen if the client doesn't use it. Making a normal old DNS request is still unencrypted, so a sniffing something can see what domains you're visiting.

Then, even if it was encrypted, the whole point of DNS is to transform a domain name to a numeric IP address. This IP is then used to request the content of the website itself. Anything on the way there (your ISP, some other commercial internet nodes, the websites hoster, etc.) can see the target IP (and yours too).

And the content of the request will also contain the domain again, because there might be several different domains on one IP. This is true for both HTTP and HTTPS, and both times it is not encrypted. There are some plans for HTTPS to make encryption of this part possible, but right now it is plaintext.

Improve this answer
4
  • Cloudflare supports both DNS over TLS and DNS over HTTPS. It is still normal DNS requests done by clients, but using new transports.
    – Patrick Mevzek
    Commented Jul 20, 2018 at 2:05
  • @PatrickMevzek So what? HTTPS basically is HTTP over TLS, but sending a plain HTTP request isn't encrypted just because the server can use HTTPS too. The client actually needs to use it, same as here.
    – deviantfan
    Commented Jul 20, 2018 at 9:34
  • So I was trying to be more precise than your "Cloudflares DNS might support some encrypted transfer," which is vague. And there is no DNS over HTTP, it is only over HTTPS. So please just use the appropriate terms, it will make your answer better.
    – Patrick Mevzek
    Commented Jul 20, 2018 at 13:14
  • 1
    @PatrickMevzek I can't find where I talk about "DNS over HTTP" or "DNS over HTTPS". ... My whole point is that the client must explicitly use any sort of encrypted DNS variant. If the client sends a plain old unencrypted DNS request, nothing the server "could" do will help.
    – deviantfan
    Commented Jul 20, 2018 at 14:02
1
  1. Your ISP does see the IP address you are accessing. But it does not necessarily reveal the target, because that IP could be a Google/Amazon load balancer or something. But in general case, the real target may be found.
  2. For now, TLS handshake (which is used in HTTPS) is revealing a domain name in clear text in order to resolve which domain certificate should be given (several domains can target one IP). But a workaround is coming soon.
Improve this answer
1

Yes your IP will be 'leaking'. By using secure DNS, your queries won't be 'readable' to anyone except the DNS service and you. But your own IP address will be viewable to IPS.

Same about HTTP and HTTPS, the IP address will always be viewable, but in HTTPS the traffic between you and the server will be encrypted, and therefore won't be readable to others. In HTTP all will readable.

If you want to 'hide' your IP. You will need to use other services such as VPN or use the TOR network.

Improve this answer
0

Yes, It leaks your IP address. It's basically a privacy-driven DNS service which provides the following benefits:

  1. Privacy: Cloudflare commits that 1.1.1.1 was designed for privacy first and will never sell your data or use it to target ads.
  2. Speed: As they mention on their website, this service is ranked #1 by DNSperf.
Improve this answer
1
  • 2
    “Never sell your data or use it to target ads” covers only a small part of what privacy really means. You could argue that you lose even more privacy when using Cloudflare’s DNS service rather than your ISPs.
    – Steve
    Commented Mar 25, 2019 at 5:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .