How does it work?

For example, could OpenDNS be tracking everything (source ip + requested url) and then selling it to who have the necessary information to correlate the ip addresses with people profiles (i.e. BigData Companies, DataBrokers, Social Networks, etc).

I'm pretty sure that ISPs could be doing that. They did with my contact information (sell without permission).

Or has OpenDNS received more than 50 millions in funding only to offer this service:

In October 2009, OpenDNS began offering an Enterprise service, which includes malware protection, delegated administration and block page bypass, in addition reliable DNS and Web content filtering. - See more at: http://www.crunchbase.com/organization/opendns#sthash.nIyr147U.dpuf


Your browser handles what is sent to the DNS service. It should only send the domain name, not the path or parameters.

The DNS service depends on what you have set in your network settings. It might be OpenDNS or Google, but it might be handled by the DHCP server of your network. In that case the DNS server is probably the router. If the router does not know the ip address of that domain name, it has its own DNS server, probably from the ISP. If that DNS server has no knowledge of that domain, it goes up in the chain until it ends up by requesting the root DNS servers for the ip address of the domain.

Your browser keeps a cache of visited websites. It does not sent out a DNS request everytime you visit a website. The same goes for each DNS server - they all have their cache. Domain names have a TTL setting, which sets how long the domain name should be kept in cache before checking. This is normally 24 hours. So once every 24 hours, the domain name is checked for the proper ip address.

All in all, it looks like they won't be able to see what you do on the web, except that you have visited a particular website that day.


Yes, partially. In fact, that is (probably) why Google offers DNS servers for public use.

Such a DNS server would not know all the information about you, though. It knows:

  • The immediate upstream server that the request came from
  • The FQDN of the server that you are trying to visit (e.g., security.stackexchange.com)
  • Sometimes, the source of any embedded content on sites you are visiting (for instance ads by Doubleclick, images from a CDN, sites hosting Javascript, etc.)
  • The destination domain of emails (from MX record lookups)
  • In some cases also what other activities you might be engaging with that server (for instance, if your computer tries to look up an SSHFP record, it is safe to assume that you are going to use SSH).
  • It may also be possible (I don't know for sure) to identify what type of device requested a particular DNS name.

It does not know: * Where the request actually originated (i.e., if you use your ISPs DNS server, and your ISP uses Google as a forwarder, then Google would only see your ISP's DNS server, not your personal computer) * The rest of the URL, cookies, etc. In some cases, knowing other domains that were requested at the same time may disclose some information. * How often you visit a particular site within a few minutes. Generally, your computer will request a domain only once, and then keep the information cached for a while. So the DNS server only sees one request for security.stackexchange.com even if you browse a dozen pages on that site.

Bottom line: some tracking is possible, but it will not be comprehensive and probably of little direct use to advertisers. It may be very valuable for state actors, though - simply knowing that somebody looked up the domain "www.wikileaks.com" or "www.howtojointhejihad.com" can be interesting.

For a company like Google, the value is probably more in the aggregate - their DNS servers give them an idea which Web sites are most popular, and may also tell them about Web sites that Google's crawlers haven't discovered yet.


Actually, in the dissertation privacy deficiencies of the Domain Name System, inference attacks, behavior-based tracking of users, and lightweight privacy enhancing technologies for DNS (German: "Beobachtungsmöglichkeiten im Domain Name System: Angriffe auf die Privatsphäre und Techniken zum Selbstdatenschutz", Dominik Herrmann, 2014) a heuristical technique was described and implemented that was able to generate user behavior logs based on DNS requests.

By logging one's visited websites and the duration spent on each website, the author was able to pinpoint specific users out of roughly 12,000 people with an accuracy of >70%. I didn't dig deep into the paper as it's over 400 pages long, but the bottom line was that DNS servers could indeed log users requests for commercial use, at least to some extend.


IIRC, DNS service has nothing to do with URLs, the sole thing it does is resolving a domain name into an IP address, which is used to actually connect to the site. So no, they can't point out the specific URL you're trying to visit.

Then, surely one could log the source IP together with the domain name being requested, aggregate the data, and sell it. I see no potential technical issues with this data being collected except for its volume, and nowhere it says they are not allowed to do it (or does it?) There is an extra step to correlate the date with specific persons, but my guess would be this is tractable for the parties interested in buying the info.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy