[...]
Now here's the catch. DNS resolution doesn't happen over a single connection. Your resolver might have to talk to multiple nameservers to figure out an IP address, and these queries are traditionally sent over plaintext DNS, usually UDP. Which means, you guessed it, your ISP can snoop on or even tamper with your DNS traffic."
This article raises several excellent points.
Basically, unencrypted DNS requests are not private.
Even encrypted DNS, once it gets to the DNS Server wherever that is, is no longer private to the owner of that DNS server, because it is unencrypted there... it may go nowhere from there, but then again, there could be logging and/or monitoring...
And DNS servers that you think don't belong to your upstream ISP -- can be proxied/rerouted by your upstream ISP...
If those points are understood by consumers, then an average person can clearly see why there is such a market (and that's the magic word, "market") for privacy solutions, i.e., encrypted VPN's, encrypted 3rd-party DNS, IP source address anonymization, etc., etc., here in the U.S. ...
In other words, a savvy privacy company or companies could sell to all U.S. Internet customers regardless of who their upstream ISP is, or what their upstream ISP promises in terms of privacy, if (and it's a big if!) they truly understand these issues and could explain them from the ground up, one-to-one, to all such potential customers...
Yes, there are a lot of VPN and other such companies, and prior customers already (not to mention free alternatives, such as Tor (but I still have questions about the exact quality of privacy Tor actually provides given browser fingerprinting and other related technologies), but that market is still segmented, has a relatively low bar for entry, and is still "up-for-grabs" for new small companies (i.e., no need to invest billions in a datacenter of GB300's to get your first AI model out...)...
Anyway, great article.
I never considered some of these issues (or their implications!) before reading it!