Aggy is a veteran writer and editor in the technology and gaming space. Having served as a Managing Editor for high-traffic digital publications, alongside being an editor and consultant for over a dozen sites. Aggy’s published work spans a wide and respected array of tech and gaming outlets, including WePC, Screen Rant, How-To Geek, Android Police, PC Invasion, and Try Hard Guides.
Beyond editorial work, Aggy’s direct experience in the tech sphere extends to app development. Aggy has published two games under Tales and is always eager to learn and do more. He also likes working on computers and researching in his spare time.
He knows about Windows, Linux, Audio, Video, and much more.
Your carrier sees a lot more than you think it does, and it’s all because everything you do is being logged. Before any of the encryption you’re used to seeing kicks in, your phone has already sent your carrier a plain-text record of every site you’re trying to reach. That happens constantly, in the background, for every app on your device, not just your browser.
Your carrier can see the sites you visit
They see your traffic because your phone sends requests in plain text
Browsing on your phone relies on DNS to convert site names into the IP addresses the network needs to find them. For years, DNS wasn’t encrypted at all, so anyone could read those requests as they crossed your connection. On an Android phone with stock settings, each time you launch an app or load a site, the phone fires off one of these unprotected requests through your carrier’s network to its own DNS servers.
Since nothing’s hidden, anyone in the right spot on the network, including your carrier, can watch and log every domain your phone asks for. A lot of people think the padlock in their browser means their carrier is blind to what they’re doing, but that’s only kind of right.
HTTPS does a solid job scrambling the actual content of your browsing. So the page’s text, your login info, the full URL, and plenty of other things are secure. However, it doesn’t protect the DNS lookup, which has to happen before that scrambled connection even starts. Your phone has to ask for a site’s address before it can connect, and that request goes out unprotected.
On top of that, even while the scrambled HTTPS setup is happening, your device transmits the site’s name as plain text in the SNI field, which your carrier can read too. Carriers keep all these DNS records around for several reasons. Some of it is just normal network upkeep, like directing traffic and catching problems.
But those logs are also worth money, since carriers can use them to build profiles on subscribers and target ads. Many places also have laws requiring carriers to retain this data for police. Some carriers even grab DNS requests and reroute them to their own machines, no matter what your settings say. So your carrier ends up with a pretty complete list of almost every site and service your phone connects to.
You can hide your traffic by encrypting your DNS
You just need to change a few settings in Android or Chrome
You can either do a phone-wide setting called Private DNS that’s baked into Android, or a browser-level setting inside Google Chrome. They work differently and cover different chunks of your traffic.
Android was actually the first big mobile OS to support encrypted DNS across the whole system, adding it way back in Android 9. Private DNS encrypts your DNS requests, so your carrier can’t read them as they pass through its network.
To switch it on, head to Settings, then Network & Internet or Connections on Samsung phones, then Advanced or More Connection Settings, and tap Private DNS. You can pick Off, Automatic, or a Private DNS provider hostname. The default Automatic mode tries to use encryption if your carrier supports it, but if it doesn’t, your phone quietly goes back to sending requests unprotected. So you might think you’re covered when you aren’t.
To make sure your DNS is always encrypted, select “Private DNS provider hostname” and enter the address of a third-party DNS provider you trust. Solid picks include Cloudflare (1dot1dot1dot1.cloudflare-dns.com), Google (dns.google), Quad9 (dns.quad9.net), and AdGuard (dns.adguard-dns.com). In this mode, Android forces every app, background service, and browser on your phone to use that encrypted connection.
If it can’t reach the encrypted server for some reason, it just stops looking up sites until it can, instead of falling back to your carrier’s unprotected servers.
Chrome has its own DNS encryption option called Secure DNS, which uses a slightly different protocol called DNS-over-HTTPS. You’ll find it under Settings, then Privacy and Security, then Use Secure DNS. Out of the box, it’s set to use your current provider, so if your carrier doesn’t support encrypted DNS, Chrome keeps sending lookups unprotected. To lock it down, flip it to “Choose another provider” and choose something like Cloudflare or Google from the list.
The big difference is what each one covers. Android’s Private DNS covers everything on your phone: every app, every background process, the whole lot. Chrome’s Secure DNS only covers what you do inside Chrome. If you want your entire phone protected, the Android-level option is the one to pick.
Encrypting your DNS does not hide everything
You still need a VPN to completely hide your traffic
Encrypting your DNS is a real step up for privacy, but it doesn’t make you invisible to your carrier. DNS encryption only handles the part where your phone looks up a site’s address. After that, your phone still has to actually reach that site over your carrier’s network, and there are a few ways your carrier can still work out where you’re headed.
The most obvious one is the destination IP address. When your phone connects to a web server, the carrier sees the IP address you’re connecting to. If a site has its own dedicated IP, your carrier can figure out which site it is just by looking that IP up. Giant hosting companies and content networks make this tougher since millions of sites share the same IPs, but plenty of sites can still be picked out this way.
Then there’s the SNI problem again. Even with encrypted DNS, your phone still transmits the site’s name as plain text while the initial connection is being set up, so a carrier watching your traffic can read it right there.
There’s a newer feature called Encrypted Client Hello that’s supposed to fix the SNI problem by encrypting that part of the connection too. Chrome, Edge, and Firefox already support it, but Safari doesn’t yet, and a lot of sites and hosting companies haven’t adopted it.
Still, until it catches on, SNI leaks are one of the easiest ways for carriers to tell what you’re visiting.
That doesn’t mean encrypting DNS is pointless, because unencrypted DNS is the simplest and cheapest way for carriers to log everything you do in bulk, totally automatically. Encrypting it forces them to work much harder if they want to track you, and it also protects you from things like DNS hijacking, ad injection, and your carrier quietly rerouting your lookups.
If you want more complete protection from people looking at what you’re doing, a VPN is the next step. When you run a full-tunnel VPN on Android, it encrypts all your traffic and routes it through a single server, so your carrier just sees a stream of encrypted data going to one IP address.
You’ll never be completely secure
Turning on Private DNS on Android takes about thirty seconds and is well worth it, but it’s not a complete fix. Your carrier can still figure out where you’re headed. Encrypted DNS removes the easiest way for your carrier to track you, and because the Android setting covers your whole phone, you get that protection without trusting a VPN provider.
Discover more from PMN S.P.O.R.T.S - A PRIME MEDIA NETWORK BRAND
Subscribe to get the latest posts sent to your email.
