Most internet users assume that because the padlock icon (HTTPS) appears in their browser bar, their internet service provider (ISP), Wi-Fi administrator, or mobile carrier cannot see what they are doing online. While HTTPS encrypts the contents of web pages, passwords, and form submissions, standard legacy DNS transmits the domain name of every single site you look up in clear, unencrypted plaintext.
The Plaintext DNS Vulnerability
When you type sendlyshare.com, your computer queries your local router or ISP resolver using standard UDP port 53. Anyone positioned between your laptop and the resolver—your university network admin, hotel Wi-Fi router, or ISP—can record an exact timeline of your web browsing habits.
In many jurisdictions, ISPs legally package and monetize this browsing metadata, selling anonymized behavioral profiles to advertisers and data brokers.
Enter DoT and DoH: Encrypted Resolution
Two modern protocols were designed to encrypt DNS queries:
- DNS over TLS (DoT): Uses dedicated TCP port 853 with TLS encryption. It is clean and system-wide, but because port 853 is distinct, network administrators can easily identify and block DoT traffic.
- DNS over HTTPS (DoH): Wraps DNS queries inside standard HTTPS traffic on port 443 (HTTP/2 or HTTP/3). Because DoH traffic is indistinguishable from normal encrypted web browsing, it cannot be selectively blocked or snooped on by intermediate middleboxes.
Achieving Full Privacy with Encrypted Client Hello (ECH)
Encrypted DNS hides your DNS queries, but standard TLS handshakes previously revealed domain names through the Server Name Indication (SNI) header. The latest standard—Encrypted Client Hello (ECH)—now encrypts the SNI portion of the TLS handshake as well, closing the final visibility gap.
Pairing secure DNS configuration with zero-knowledge, browser-to-browser utilities (like Sendly's Zero-Knowledge Transfer) ensures that neither your ISP nor intermediate network gateways can inspect your data, payloads, or communications.