DNS Speed & Privacy | bitandboot Systems Lab

🔬 Networking Note

"By default, your router routes every request through your ISP's localized resolver tables. These tables are regularly bottlenecked during peak hours, and every domain you visit is logged there — even sites you access over HTTPS."

⚡ Fast Diagnostic Summary

The core issue: your device translates domain names like github.com into IP addresses via DNS — and by default, that lookup runs through your ISP's often slow, always-logged resolver.
The privacy gap: even encrypted HTTPS traffic leaks the domain name during a standard DNS lookup, giving your ISP a readable log of every site you visit, regardless of what you're doing on it.
The fix: point your device or router at a fast, privacy-respecting public resolver — Cloudflare (1.1.1.1), Google (8.8.8.8), or Quad9 (9.9.9.9) — for a typical latency drop from 1000ms+ down to under 20ms.
The stronger fix: enable DNS over HTTPS (DoH) or DNS over TLS (DoT) so the lookup itself is encrypted end-to-end, closing the visibility gap entirely — not just changing who can see it.
The trade-off to know: some CDNs use your resolver's location to route you to the nearest server — switching to a distant public resolver can occasionally add a few milliseconds to content delivery, even while DNS lookup itself gets faster.

When you click a link or type a web address, your device doesn't inherently know where that website lives. Computers don't understand words like github.com — they only route traffic using numeric IP addresses. The bridge that translates human-readable text into machine coordinates is the Domain Name System (DNS), and by default, you're routed through whatever resolver your ISP assigned you — usually the least optimized option available.

1. The Phonebook Analogy, and Why It's Incomplete

Think of DNS like your phone's contacts app: you tap a name instead of memorizing a ten-digit number, and the lookup happens invisibly behind the scenes. But the phonebook analogy undersells what's actually happening — a single DNS lookup for a simple domain typically involves several layers of servers cooperating in sequence:

Recursive Resolver: the first server your device asks — this is usually your ISP by default, or a public alternative like Cloudflare once you switch. It does the legwork of tracking down the answer on your behalf.
Root Server: the resolver's first stop, which doesn't know the exact answer but points it toward the right Top-Level Domain (TLD) server based on the ending of the domain (.com, .org, .io).
TLD Server: narrows the search further, pointing to the specific Authoritative Nameserver responsible for that exact domain.
Authoritative Nameserver: the final source of truth — it holds the actual IP address record for that domain and returns it to the resolver.

Once the resolver has the answer, it caches it for a period defined by the domain's TTL (Time To Live) — so the next few thousand people who ask for the same domain get an instant cached answer instead of repeating that whole four-step chain.

The Privacy Loophole: because your resolver — typically your ISP — is the very first server that sees your request, it can log a complete history of every domain you query, timestamped, even if the actual page content is fully encrypted over HTTPS. The lock icon in your browser protects what you read; standard DNS does nothing to protect which site you asked for.

2. Why the Default Is Almost Always Slow

Your ISP's resolver isn't necessarily slow because of incompetence — it's usually a matter of scale and investment. Consumer ISPs serve DNS as a low-priority side function on aging infrastructure, often centralized in just one or two regional data centers, while dedicated public resolvers like Cloudflare and Google operate global Anycast networks: the same IP address (1.1.1.1, for instance) is broadcast from hundreds of physical locations worldwide, and your request is automatically routed to whichever one is geographically closest to you, typically resolving in single-digit milliseconds.

3. Choosing a Public Resolver: A Real Comparison

Not all public DNS providers are interchangeable — they differ meaningfully in what they log, what they filter, and what they optimize for:

Provider	Primary Address	Optimized For	Logging Policy
Cloudflare	`1.1.1.1`	Raw speed, minimal logging	No domain logs retained beyond 24h for debugging, independently audited
Google Public DNS	`8.8.8.8`	Global fault tolerance	Temporary logs retained, tied to Google's broader data ecosystem
Quad9	`9.9.9.9`	Security + malware blocking	Non-profit, no personal data sold, blocks known malicious domains at the resolver level

4. Going Further: Encrypting the Lookup Itself

Switching resolvers fixes who can see your DNS queries — it doesn't fix the fact that standard DNS traffic is sent in plaintext, meaning anyone on the network path (a public Wi-Fi operator, for instance) could technically observe it. Two newer protocols close that gap by encrypting the DNS query itself:

DoH (DNS over HTTPS): wraps DNS queries inside standard HTTPS traffic, on the same port browsers already use for web pages — making DNS lookups indistinguishable from regular web traffic to anyone monitoring the network.
DoT (DNS over TLS): encrypts DNS queries using TLS on a dedicated port, giving network administrators a clear, filterable signal that DNS traffic is happening (useful for corporate/school networks), while still keeping the query content itself encrypted.

Practical note: most modern browsers (Firefox, Chrome, Edge) now support DoH natively in their network settings, meaning you can encrypt your DNS lookups without touching OS-level or router settings at all — a lower-friction entry point if you're not ready to change system-wide settings yet.

5. Implementing the Change Natively

On Windows 11: Settings → Network & internet → Wi-Fi → Hardware properties. Find DNS server assignment, switch to Manual, and insert 1.1.1.1 (and 1.0.0.1 as a secondary).
On Apple macOS: System Settings → Network → Wi-Fi → Details. Select the DNS tab, hit '+', and input 1.1.1.1.
On Mobile Handsets: Navigate to your Wi-Fi connection configuration, switch IP settings from DHCP to Static, and locate the DNS fields to append your numbers — or, more simply, use your OS's built-in "Private DNS" toggle (Android: Settings → Network → Private DNS → set to 1dot1dot1dot1.cloudflare-dns.com for automatic DoT).
On your router (whole-home effect): changing DNS at the router level applies the fix to every device on your network at once — phones, laptops, smart TVs, game consoles — without configuring each one individually. Look for a "DNS" or "WAN DNS" field in your router's admin panel, usually reachable at 192.168.1.1 or 192.168.0.1.

6. What You Might Notice, and What You Won't

Once switched, page-load-initiating requests resolve dramatically faster on first visit to any new domain — the difference is most noticeable browsing to sites you haven't visited recently, since cached domains were already fast either way. One trade-off worth knowing honestly: some Content Delivery Networks (CDNs) use your resolver's physical location to route you to the geographically nearest content server. A small number of users report marginally slower large file downloads after switching to a distant public resolver, since the CDN's routing logic gets slightly less accurate about where you actually are. For the vast majority of everyday browsing, the DNS lookup speed and privacy gain far outweighs this edge case.

DNS Speed & Privacy: Why Changing Four Numbers Instantly Secures Your Connection