In reply to a post by TinyMongomery:

HTTPS doesn’t encrypt the destination IP address. Routers still need to know where to route packets to.

Great, its an AWS or Azure IP or a load balancer. Really tells them nothing.

Depends who “them”is. If it’s Microsoft …

My point is that there is a lot more to worry about, security- and privacy-wise, on the Internet than whether someone can see your DNS queries. Far more important is how reliable the answers to those queries are.

Run a local DNS server and there won’t be so many requests to external servers in the first place.

In reply to a post by TinyMongomery:

Depends who “them”is. If it’s Microsoft …

My point is that there is a lot more to worry about, security- and privacy-wise, on the Internet than whether someone can see your DNS queries. Far more important is how reliable the answers to those queries are.

Run a local DNS server and there won’t be so many requests to external servers in the first place.

Or you can just accept that like 99% of people you're of no interest to anyone and no-one in authority cares what you do

In reply to a post by smouty:

In reply to a post by jchamier:

Exactly, with some services if you use your ISP hosted DNS you get faster performance.

Which is fine if you do not mind them harvesting your browsing habits and selling the data on.

Unbound is best for privacy but not so easy to setup for people with a consumer type router.

How does Unbound prevent your ISP from harvesting DNS queries -- you'll be making unencrypted queries to the authoritative nameservers, which your ISP could snoop on if they wanted. If you don't trust your ISP, wouldn't one of the forms of encrypted DNS be better?

Exactly.

In reply to a post by behuk:

How does Unbound prevent your ISP from harvesting DNS queries -- you'll be making unencrypted queries to the authoritative nameservers, which your ISP could snoop on if they wanted. If you don't trust your ISP, wouldn't one of the forms of encrypted DNS be better?

Or a router that does encrypted from your home to internet, and lets really basic appliances (e.g. your DVD player) query the router over unencrypted DNS.

In reply to a post by behuk:

How does Unbound prevent your ISP from harvesting DNS queries -- you'll be making unencrypted queries to the authoritative nameservers, which your ISP could snoop on if they wanted. If you don't trust your ISP, wouldn't one of the forms of encrypted DNS be better?

Unbound can be encrypted if the root server supports it.
DNS should be be more secure if only for integrity rather than the privacy it offers as as well.