Who Runs Your DNS Resolver, and Why It Matters

Every time you visit a site, some server is told the hostname you asked for. That server is your recursive resolver, and by default you did not choose it — your router advertised it when your device joined the network, and your device accepted. On most home connections that means your internet provider’s resolver.

Because the resolver receives a complete, timestamped list of the names you look up, deciding who runs it is one of the more consequential privacy settings you have, and one of the least visible.

How you ended up with the one you have

Resolver settings are handed down a chain, and any link can override the one above it.

Your provider tells your router which resolvers to use. Your router advertises those, or its own, to devices on the network via DHCP. Your device accepts what the network offers unless it has been configured otherwise. And individual applications — browsers, most notably — may hold their own resolver settings and ignore the system’s entirely.

The result is that the answer to “which resolver am I using” can differ per device on the same network and per application on the same device. It is worth checking rather than assuming, and reading your own network settings is where you find the per-interface values.

What the resolver operator can see

The list of names, and enough context to make it meaningful.

A resolver receives the hostname, the time, and the address of whoever asked. On a home connection that address identifies your household. The queries reveal which services you use, when you are awake, which devices are active, and — through the domains of update servers, apps, and embedded content — a good deal about what hardware and software you own.

It does not see the contents of your traffic, and it does not see the specific pages you visited within a site, because only the hostname is looked up. That is a real limit and worth stating plainly. But the hostname list alone is a strong picture.

What happens to that data depends entirely on the operator: whether queries are logged, for how long, whether they are aggregated, and whether they are used for anything beyond answering. Those are policy questions, not technical ones, and the honest position is that you are trusting a stated policy.

The realistic options

Four broad choices, with different tradeoffs.

Your provider’s resolver. The default. It is usually fast because it is physically close, and it already knows which addresses you connect to, so it is not learning something entirely new. The downside is that your provider gets a clean, structured record of names alongside the traffic data it already holds.

A large public resolver. Operated independently of your access provider, generally fast and reliable, and typically offering encrypted transport. You are moving the record from your provider to a different company — which is a real change, not an elimination. Choose one whose stated policy you are willing to rely on.

Your router’s resolver. Some routers resolve names themselves rather than forwarding. This changes where caching happens but not who ultimately gets asked, since the router still has to walk the hierarchy through someone.

Your own resolver. Running a resolver on your own network means queries go straight to the authoritative servers, so no single operator sees your full list. The authoritative servers each see only queries for their own domains. The cost is setup, maintenance, and slower cold lookups, and your queries are still visible to anyone watching the network path unless they are encrypted.

There is no option where nobody learns anything. The choice is about who, and how much they can correlate it with.

Encryption is a separate question from choice

Choosing a different resolver and encrypting the path to it are two independent decisions.

Traditional DNS queries travel unencrypted, so anyone on the network path — the local network operator, a public Wi-Fi provider, intermediate networks — can read them regardless of which resolver you picked. Encrypted transports fix that specific exposure by wrapping queries so only the resolver can read them.

What encryption does not do is hide the queries from the resolver itself. That is the point that gets lost most often, and it is the core of DNS over HTTPS versus a VPN: encrypted DNS protects the path, a VPN protects the path and moves who sees the queries, and neither hides your activity from the party you have chosen to ask.

What a VPN does to your resolver

A working VPN client replaces your resolver with one reachable through the tunnel. That shifts the record from your provider to your VPN provider, and it means the queries travel inside the encrypted path so no one on the local network can read them either.

Two things to verify rather than assume:

That the replacement actually happened. If the client sets a tunnel resolver but the operating system keeps querying the physical adapter’s as well, your provider still gets the list. That is a DNS leak, and it is common enough that testing for it is routine rather than paranoid — checking for leaks covers the method.

Whose resolver the tunnel points at. Some providers run their own; some forward to a third party. If a VPN provider’s argument for your trust is that it keeps minimal records, and it hands your lookups to someone else, that is worth knowing before you rely on it.

Overriding the choice deliberately

If you want a specific resolver, set it explicitly and set it in one place.

You can configure resolvers on the router, which applies to every device that accepts what the network offers, or per device, which survives joining other networks. Doing both is fine; doing them inconsistently produces confusing results where different devices resolve differently.

Two complications to watch for. Browsers with their own encrypted DNS enabled will bypass whatever you configured at the system level, so a system-wide setting may not be what your browsing actually uses. And a VPN client will normally override your setting while connected, which is usually what you want — but it means your careful configuration applies only when the tunnel is down.

The check worth doing once

Find out which resolver each of your devices is actually using, connected and disconnected. It takes a few minutes, it frequently surprises people, and it is the only way to know whether your resolver is the one you think it is.

Then decide deliberately. The default is not wrong — your provider’s resolver is fast and already knows a lot — but it should be a decision rather than an accident, because the party that receives your list of hostnames is doing more privacy-relevant work than almost anything else in the path.