Your isp logs every site you visit—swap two numbers and cut the cord
Each time you tap a url, your browser fires off a plaintext question—‘where is bbc.com?’—and your ISP’s DNS server answers, timestamp in hand. That 40-byte request is enough to map your entire digital day, yet most routers still ship with the provider’s resolver baked in, silently photocopying every destination for resale or regulation.
The fix is almost insultingly simple: type 1.1.1.1 or 9.9.9.9 into the dashboard and hit save. Do it once at the router and every phone, fridge and games console inherits encrypted queries without further tinkering. Cloudflare wipes logs after 24 hours, Quad9 cross-checks each hostname against 20-plus threat feeds before replying, and both outperform national telcos by 20–40 ms inside Europe thanks to anycast meshes the incumbents still call ‘experimental’.
Why your carrier keeps the lights off
Incumbent DNS servers run on 1990s code, patched just enough to keep regulators quiet. Deploying DNS-over-TLS (DoT) or DNS-over-HTTPS (DoH) means new certificates, traffic diaries and, crucially, surrendering the raw clickstream that fuels their advertising upsell. Small wonder the major Spanish ISPs lobbied to keep router firmware locked; an open panel would let users walk away from the data buffet in seconds.
Man-in-the-middle attacks love this inertia. Camp-out on a public wi-fi gateway, sniff port 53, inject a spoofed reply pointing paypal.com to a cloned page, and credentials rain like confetti. Because the resolver is unauthenticated and unencrypted, the browser never notices. The same trick fails against Cloudflare or Quad9—queries ride inside TLS tunnels the attacker can’t read, far less rewrite.
The half-second that pays for itself
Swapping resolvers is not just hygiene; it is acceleration. A test across ten UK homes shows Quad9 returning answers in 12 ms versus 54 ms for the carrier, simply because the nearest anycast node sits inside the city exchange while the ISP still backhauls requests to a legacy box two counties away. Multiply that 42 ms by the 150-odd domains modern pages call and you shave a full second from load times—no fibre upgrade required.
Lock the door, then sweep the room. After switching, spin up NextDNS for five minutes: it surfaces every sneaky CNAME tracker your filter lists missed. Block them once, sync the profile to the router, and the same blacklist follows your laptop to cafés, airports and hotels—no client-side app needed.
Your data is already the commodity everyone trades; at least set the price yourself. Two numbers, one click, zero tolerance for anyone who sells your curiosities by the kilobyte.