1

Do Public DNS servers log our DNS queries? I started running my own AdGuard Home in the cloud using Oracle Compute Instance. In AdGuard Home's dashboard, it logs my DNS queries.

enter image description here

I was wondering if Public DNS servers such as Cloudflare, Google, Quad9, and others do the same?

Since I'm already using my own DNS server, did I really keep my browsing activities or my ISP still can see it?

1
  • A security/privacy mindful posture is always to suspect the worst and plan accordingly. If you don't want to have public resolvers seeing your traffic and logging it, then just don't send your traffic to them. You can fully resolve names locally, and it might even be a better option, specially for DNSSEC, than relying on external public nameservers. May 29 at 16:33

2 Answers 2

2

Do Public DNS servers log our DNS queries?

Why would a commercial venture offer a "free" service in the first place? It doesn't have to be evil but there is usually a trade-off involved. A public DNS service is a large-scale data mining operation of some sort. Note that it can have positive aspects, for example the tracking of malware/ransomware. So there is a strong "threat analysis" aspect here. Essentially, this is a crowdsourced effort.

They may "censor" queries for protection purposes too, by "sinkholing" requests to malicious hosts. Discussion: Understanding DNS sinkholes – A weapon against malware.

In the case of actors such as Google, there is one obvious usage: to discover new websites to crawl. Another obvious source for that is the certificate transparency logs. Since a search engine cannot "guess" all the websites in existence, the DNS lookups are a great data source.

On the Internet, assume everything is "logged", meaning: an entry is automatically written to a log file, typically along with some PII (personally identifiable information) like remote IP address and ports. Any connection to a website or a mail server leaves a trace in the logs, which can be short-lived, but not always. The logs can be archived, purged, rotated depending on corporate policy.

So the better question you probably have in mind is, do they exploit the data? Yes. Look at this Wikipedia page for an example (OpenDNS). It further elaborates on the usage of collected data.

Since I'm already using my own DNS server, did I really keep my browsing activities or my ISP still can see it?

That depends. If you're just using an alternate resolver for your DNS queries then your ISP can still pretty much see everything since they carry your Internet traffic. You're hardly hiding anything.

If you were using a VPN and directing DNS queries through the VPN tunnel to another resolver then your ISP would see little, just some (encrypted) VPN traffic.

The bottom line is that DNS queries are very telling metadata. Even without the full traffic, you can figure out the user activity (what kind of sites they do visit).

1

Do they log them? Most likely, companies such as Google state that they do not use it for ads purposes (https://developers.google.com/speed/public-dns/privacy#:~:text=Terms%20of%20Service.-,Our%20Commitment,DNS%20service%20to%20target%20ads.) but still keep in mind that you are using their servers to perform a lookup. In the end your request will end on their side. Regarding your question about your ISP, please bear in mind that unless you are using encrypted DNS the rest goes in clear text and yes, your ISP will be able to see that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.