Do Public DNS servers log our DNS queries? I started running my own AdGuard Home in the cloud using Oracle Compute Instance. In AdGuard Home's dashboard, it logs my DNS queries.
I was wondering if Public DNS servers such as Cloudflare, Google, Quad9, and others do the same?
Since I'm already using my own DNS server, did I really keep my browsing activities or my ISP still can see it?
Do Public DNS servers log our DNS queries?
Why would a commercial venture offer a "free" service in the first place? It doesn't have to be evil but there is usually a trade-off involved. A public DNS service is a large-scale data mining operation of some sort. Note that it can have positive aspects, for example the tracking of malware/ransomware. So there is a strong "threat analysis" aspect here. Essentially, this is a crowdsourced effort.
They may "censor" queries for protection purposes too, by "sinkholing" requests to malicious hosts. Discussion: Understanding DNS sinkholes – A weapon against malware.
In the case of actors such as Google, there is one obvious usage: to discover new websites to crawl. Another obvious source for that is the certificate transparency logs. Since a search engine cannot "guess" all the websites in existence, the DNS lookups are a great data source.
On the Internet, assume everything is "logged", meaning: an entry is automatically written to a log file, typically along with some PII (personally identifiable information) like remote IP address and ports. Any connection to a website or a mail server leaves a trace in the logs, which can be short-lived, but not always. The logs can be archived, purged, rotated depending on corporate policy.
So the better question you probably have in mind is, do they exploit the data? Yes. Look at this Wikipedia page for an example (OpenDNS). It further elaborates on the usage of collected data.
Since I'm already using my own DNS server, did I really keep my browsing activities or my ISP still can see it?
That depends. If you're just using an alternate resolver for your DNS queries then your ISP can still pretty much see everything since they carry your Internet traffic. You're hardly hiding anything.
If you were using a VPN and directing DNS queries through the VPN tunnel to another resolver then your ISP would see little, just some (encrypted) VPN traffic.
The bottom line is that DNS queries are very telling metadata. Even without the full traffic, you can figure out the user activity (what kind of sites they do visit).
Do they log them? Most likely, companies such as Google state that they do not use it for ads purposes (https://developers.google.com/speed/public-dns/privacy#:~:text=Terms%20of%20Service.-,Our%20Commitment,DNS%20service%20to%20target%20ads.) but still keep in mind that you are using their servers to perform a lookup. In the end your request will end on their side. Regarding your question about your ISP, please bear in mind that unless you are using encrypted DNS the rest goes in clear text and yes, your ISP will be able to see that.
