August 13, 2026
DNS tea: encrypted or exposed?
How a device finds encrypted DNS by itself
Your gadgets may secretly ask for safer internet — and the comments are already fighting
TLDR: This update lets devices ask whether their current internet name service has a safer encrypted version and switch automatically. Commenters think that sounds great in theory, but many say it mainly helps big public providers and gets messy or useless on home networks.
A quiet little internet upgrade just got the full comment-section soap opera treatment. The idea is simple: when your phone, laptop, or TV joins a network, it can ask the internet’s address book service, “Hey, do you have a safer, locked version of this connection?” If the answer is yes, it switches over automatically. In theory, that means less snooping and more privacy with almost no setup. In practice? The community immediately split into “cool privacy win” and “nice idea, but this falls apart in the real world.”
The strongest reactions came from people actually running their own home or local setups, and they were not exactly popping champagne. One commenter said Apple gear really does fire off this special request every time it joins a network — but argued the “fully verified” version mostly works for big public services, not the average local home resolver. Translation: great for the giants, awkward for the little guy. Another hot take was pure hacker-comedy: a user tried the lookup manually and got a parade of error messages, basically turning the feature into a meme of “works on paper, faceplants on command line.”
That clash is the real story: the article sells a smoother path to encrypted browsing, while the comments keep yelling, “Sure, but only if your network plays nice.” It’s privacy optimism vs. admin realism, with a side of nerdy eye-rolls and terminal-window slapstick.
Key Points
- •DDR lets a device discover encrypted DNS endpoints for the resolver it is already using by supplying the hostname, port, and protocol missing from a plain resolver IP address.
- •The mechanism works through a lookup of _dns.resolver.arpa, which the current resolver answers with available encrypted endpoints and their preference order, or with no endpoints if none exist.
- •Resolvers can return the same encrypted endpoints to all devices or profile-specific endpoints so that filtering, allow lists, and logging settings apply from the first encrypted query.
- •DDR replies can include the IP addresses of named encrypted endpoints to avoid an extra hostname lookup over the unencrypted connection being replaced.
- •Upgrades that begin from plain DNS are opportunistic because the initial discovery exchange is unencrypted and can be modified by the network, so direct configuration of encrypted DNS remains stronger.