Can an ISP see DNS queries that go through DuckDuck Go?
This fact-check may be outdated. Consider refreshing it to get the most current information.
Executive summary
An Internet Service Provider (ISP) can see DNS queries if those queries are sent to a DNS resolver the ISP operates or to any unencrypted DNS service, because standard DNS is visible on the network [1] [2]. However, when a device is configured to use encrypted DNS (DNS-over-HTTPS or DNS-over-TLS) or DuckDuckGo’s own DNS via DuckDuckGo’s VPN or browser features, the ISP cannot read the plaintext DNS names — though it can observe that a device is connecting to an encrypted DNS service or to DuckDuckGo’s infrastructure [3] [4] [5].
1. What “DNS queries that go through DuckDuckGo” can mean and why that matters
“Going through DuckDuckGo” can mean at least three technical setups: using the DuckDuckGo search site over HTTPS, using the DuckDuckGo app or browser configured to send DNS to DuckDuckGo’s resolvers (including via DuckDuckGo VPN), or simply typing duckduckgo.com and relying on the ISP’s resolver; each has different visibility to an ISP [5] [3] [6]. The distinction matters because HTTPS protects search content from the ISP but not necessarily the DNS lookup itself unless DNS is also encrypted or routed through DuckDuckGo’s DNS service [5] [4].
2. The baseline: ISPs can see plain DNS lookups and domain-level connections
If a device uses the ISP’s default DNS resolver or any unencrypted resolver, the ISP typically can see the domains being looked up and thus infer which sites are being visited, because plain DNS queries are visible to the network operator [1] [2]. Multiple explainers in the reporting emphasize that DNS visibility is a separate channel from HTTPS content: HTTPS hides page contents from an ISP but not the fact of a connection to a given IP, and unencrypted DNS reveals the domain names queried [1] [7].
3. When DuckDuckGo’s servers handle DNS: what the ISP can and cannot see
DuckDuckGo’s VPN and some DuckDuckGo browser settings route DNS queries to DuckDuckGo’s DNS servers instead of the ISP’s resolver, and DuckDuckGo states this reduces logging or monetization by the ISP or third-party DNS providers [3]. In that setup an ISP cannot read the plaintext DNS queries destined for DuckDuckGo’s DNS if those queries are encrypted or tunneled via the DuckDuckGo VPN, but the ISP will still see an endpoint IP (the VPN or DuckDuckGo DNS server) and timing/volume metadata [3] [5]. The reporting indicates DuckDuckGo’s claim that your ISP “cannot see your searches” refers to encrypted search traffic, not the broader metadata picture [5].
4. Encrypted DNS (DoH/DoT) and VPNs: practical privacy gains and limits
Using DNS-over-HTTPS or DNS-over-TLS, or a VPN, prevents an ISP from snooping the contents of DNS queries in flight because the DNS traffic itself is encapsulated in an encrypted channel, so the ISP can detect the encrypted channel but not the domain names inside without additional information [4] [8]. That said, multiple sources caution that ISPs still observe connection endpoints, volumes, and timing — meaning an ISP can see that a user is connected to DuckDuckGo’s servers or to an encrypted DNS provider even if it cannot see the specific DNS names [7] [3].
5. Conflicting or overstated claims in public reporting
Some write-ups simplify the message into “ISPs cannot see your DuckDuckGo searches,” which is true for search content due to HTTPS but can be misleading if readers assume total invisibility of DNS or destination data [5]. Other sources emphasize the default visibility of DNS and urge additional tools (VPNs, DoH/DoT) to close that gap; both perspectives are accurate but target different threats and assumptions about user configuration [1] [8] [4]. The reporting does not fully quantify residual metadata risks (e.g., correlation attacks or what a particular ISP logs), so those specifics remain outside available sources (no source provided).
6. Bottom line for users and technical takeaways
If DNS queries for duckduckgo.com are performed by the ISP’s resolver, the ISP can see those queries and thus that the user accessed DuckDuckGo; if DNS is routed to DuckDuckGo’s DNS servers or an encrypted DNS service (or placed inside a DuckDuckGo VPN tunnel), the ISP cannot read the DNS names in plaintext but can see connections to those DNS endpoints and related metadata [2] [3] [4]. To eliminate plaintext DNS visibility to the ISP, users need encrypted DNS or a trustworthy VPN; to understand whether that protection is active in any particular setup requires inspecting the device’s DNS/VPN configuration, a detail not enumerated in the provided sources [8] [3].