Trace your commute

DNS lookups, resolvers and network records

What DNS lookups can reveal and who receives them

Encrypted DNS protects website-name lookups on the way to a resolver. Browser fallback and the chosen resolver's logging policy remain separate privacy questions.

Sources checked .

Conceptual illustration

A website-name lookup goes to a resolver

Mozilla explains that DNS over HTTPS encrypts the lookup between the browser and a compatible resolver. The resolver still receives the question. Encryption on that connection and the resolver's handling of received queries are separate parts of the privacy decision. Mozilla: encrypted DNS scope

Chrome automatic mode can fall back

Google says desktop Chrome's automatic Secure DNS mode can use an unencrypted lookup if secure resolution has problems. Selecting a custom provider has different fallback behavior. A label saying Secure DNS is enabled should be read together with the selected mode. Google: desktop Chrome Secure DNS and fallback

Firefox protection levels behave differently

Mozilla distinguishes Default protection, which can fall back to system resolvers, from Max protection, which warns when secure resolution is unavailable. Its current guide also describes a Custom level. Read the selected level and status together. Mozilla: DNS protection settings

Android Private DNS has a specific scope

Google's Android help says Private DNS protects DNS questions and answers only. It does not describe a general shield for everything the phone does. Browser settings and a device's network settings should be reviewed in their own documented places. Google: Android network, Private DNS and randomized address settings

Google Public DNS describes two kinds of logs

Google's service-specific notice says temporary logs include the sending IP address and query details, with deletion processes within 24 to 48 hours. Security or abuse issues can justify longer retention. Separate sampled permanent logs remove the IP address and retain query and regional metadata. These are Google's stated practices, not a rule for every resolver. Google: Public DNS temporary and permanent logs

Cloudflare describes limited logs and separate exceptions

Cloudflare's public-resolver notice describes deleting limited resolver logs and truncated IP information within 25 hours. It also describes limited APNIC access to anonymized research data and a separate sampled-network-packet exception for troubleshooting and denial-of-service mitigation. Calling the service simply log-free would miss these distinctions. Cloudflare: public resolver logs and exceptions

Questions and answers

Does encrypted DNS stop the resolver receiving the lookup?

Mozilla says the selected resolver can see the query. Mozilla: encrypted DNS scope

Does Chrome automatic Secure DNS always stay encrypted?

Google documents unencrypted fallback when automatic-mode lookups have problems. Google: desktop Chrome Secure DNS and fallback

Is Google's 48-hour description an unconditional limit on all DNS records?

Its notice preserves a security-and-abuse exception and separate permanent sampled logs. Google: Public DNS temporary and permanent logs

Sources and scope

Public Mozilla, Google and Cloudflare documents checked 10-24-2026. Browser settings, network policy, device software and the resolver service affect the actual lookup route. Provider policies are attributed examples, not product recommendations or independent audits.

Keep exploring