10

I have an interesting question and I really want to get an answer to this. What does my ISP see if I change my DNS server and I use an HTTPS connection?

Firstly, when I use my ISP's DNS server:

So, I think, when I type a certain URL in my browser (for example https://google.com), I send a request through my ISP to my ISP's DNS server, my provider gets the response (IP address of google.com), goes by this IP, sends a request to this server (google.com) and gets a response - an HTML page that will be sent to me by my provider. Is it so?

Secondly, when I use another DNS server: I think, when I type a certain URL in my browser (for example https://google.com), I send a request through my ISP to the other DNS server, my provider gets a response (IP address of google.com), goes by this IP address, sends a request to this server (google.com), and gets a response - an HTML page that will be sent to me by my provider.

Or (for second variant) When I type a certain URL in my browser (for example https://google.com), I send a request through my ISP to my ISP's DNS server in order to get the IP address of the other DNS server, my provider sends a request to the other DNS server, gets the IP address of google.com, goes by this IP address, sends a request to this server (google.com) and gets a response - an HTML page that will be sent to me by my provider.

Here follows my third question: Will I be connected to DNS if I type just the IP address (not domain name) of google.com in my URL bar?

22

So, I think, that when I type certain URL in my browser (for example https://google.com) I send request through ISP to ISP DNS and my provider gets response (ip of google.com) and goes by this IP and send request to this server (google.com) and gets response - html page that will be sent to me by my provider. Is it so?

No, this does not work as you described.

When you use the ISP's DNS server you get the IP address of the target server (google.com in your example) from the ISP. The ISP's DNS server itself provides this IP address from a cache or resolves the DNS query for you - see DNS Lookups Explained for the finer details.

Then your browser uses this IP address to access the target site itself, i.e. the ISP does not retrieve the site for you. The ISP will forward the packets from your client to the target server though, but what's inside the packets is usually irrelevant for the ISP.

There are some exceptions from this behavior though: In some cases there might be an explicit proxy at the ISP involved, where the client (i.e. your browser) asks the proxy and the proxy will retrieve the data and send it back to the client. The proxy might also cache data to serve the client faster and also to save bandwidth. Such setup was pretty common in the early days of the internet where bandwidth was more scare, but is much less common today.

Some ISP might also snoop at the traffic with Deep Packet Inspection (DPI) and might also block or delay traffic based on this. Some might also enforce an implicit proxy to modify the traffic. This is especially true in countries where the ISP is ordered to block specific sites. It happened also in the past that ISP injected their own advertisements in the traffic. Or mobile ISP where found to "enrich" the traffic to provide information about the client (like the phone number) to the final server in order to provide more targeted advertisements. Traffic modification is mostly impossible when HTTPS is used though, but blocking traffic will even work with HTTPS.

Secondly, when I use other DNS: I think, that when I type certain URL in my browser (for example https://google.com) I send request through ISP to other DNS and my provider gets response (ip of google.com) and goes by this IP and send request to this server (google.com) and gets response - html page that will be sent to me by my provider.

Again the provider is (usually) only involved in forwarding the data between client (your browser) and server, but not in requesting the data from the server itself. The main difference between using the DNS from your ISP vs using a different DNS server is that another DNS server now resolves the query for you. This might be desired if one does not trust the ISP and fears blocking of sites or logging of what sites you access (i.e. privacy invasion). It might also be desired if the new DNS provider offers some useful features, like blocking malicious domains.

It is still possible and not uncommon though that your DNS query does not actually end at the DNS server you want to use but will still be handled by the ISP's DNS server. This can be done with a cheap redirection of all packets destined for port 53 to the ISP's DNS server. Enforcing the use of the ISP's DNS server is usually done if the ISP is ordered to block access to specific domains. But even without redirecting the ISP might be able to see what domains you query: DNS queries are by default not encrypted and thus visible to Deep Packet Inspection. When using DNS over HTTPS (DoH) or DNS over TLS (DoT) the ISP will no longer be able to intercept these DNS requests though, nor will it be able to see the content of the DNS queries. It can still determine the domains you visit from DPI on the web traffic itself though in most cases.

It`s follows third question: will I be connected to DNS if I type just IP (not domain name) of google.com in my URL bar?

If one explicitly uses the IP address no DNS lookup is needed to access the server. Note though that most servers will not work if just accessed by IP address. It is pretty common that multiple domains are served on the same IP address. Thus the server also needs the domain name to find out which certificates to provide for HTTPS and which content to serve. If one just puts the IP address in the browser, the browser does not know which domain is meant and thus cannot provide this crucial information to the server.

5
  • You can put hostname and ip in your OS hosts file. Then you can type URLs with names and the browser does still not need to DNS lookup. However you will have to maintain the IP address manually, and it is also a very imperfect protection against leaking hostnames. Not even specialized Tor Browsers are flawless in this regard.
    – eckes
    Oct 11 '20 at 4:07
  • It might perhaps be useful to note that a lot of DNS servers only serve their zones. For example, my company's DNS server will only answer requests about my company's IP addresses/names and will drop all other queries. This was, of course, more important in earlier days before Google's DNS servers. As far as I remember we couldn't just use any semi-public DNS servers, but only those who were prepared to accept queries from any country.
    – Gnudiff
    Oct 11 '20 at 19:47
  • 1
    @Gnudiff: Technically you are right. But I think it is generally assumed that of someone talks about "changing their DNS server away from the ISP" that they want to change it to something which can actually answer the queries, i.e. they pick one of the several public recursive resolvers which are explicitly marketed as an alternative to the ISP's DNS server. Oct 11 '20 at 20:01
  • 1
    Another mean trick that mobile ISPs used to get up to - recompressing images on the fly, even to the point where text in them could be unreadable. Thankfully with nearly everything running over https these days that's not the issue it used to be
    – Chris H
    Oct 12 '20 at 11:00
  • and an example w.r.t. the last paragraph: if I look up the IP address of my website, then paste that into a browser, I get my hosting provider's landing page for customers hosted on the same server
    – Chris H
    Oct 12 '20 at 11:03
2

Essentially, you are making the incorrect assumption that your DNS request is encrypted because you visit an HTTPS site.

That is NOT the case. HTTPS web traffic on port 443 may be encrypted but the DNS lookup on port 53 is not.

What you appear to be looking for is encrypted DNS which is available - for example in Firefox. The correct term is DNS over HTTPS.

However, in terms of the browsing traffic itself, there are plenty of systems now that offer wire-speed HTTPS inspection the great firewall of china is probably the most obvious example of that in action.

Now, I'm not suggesting that any UK ISPs are engaging in mass HTTPS hijacking but there are far more common similar real-world things that do happen, the most likely will be man-in-the-middle spoofing of public WiFi hotspots.

If anonymity of DNS lookups and the traffic therein is the primary objective then the best recommendation I can give you is to use a personal VPN service that both encrypts your traffic and offers their own DNS service within the tunnel.

I use PIA

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.