Question about the real security of browser encrypted secure DNS

I’m using an AMD laptop with Linux-Tumbleweed-Gnome-Wayland.

I turned on Secure DNS in my Chrome and Firefox browsers and set them to Google Public DNS 8.8.8.8 and CloudFlare 1.1.1.1. I read that DNS a query resolution can go thru multiple DNS servers like the Root server then the TLD server then a 2nd Level Domain Server. As my DNS query goes thru these levels, does it ever appear in plaintext that can be spied on by someone other than Google or CloudFlare? (assume that Secure DNS is turned on)

I’m new to this DNS stuff so let me know if my question has some mistakes.

And IIUC many DNS queries don’t go thru these levels but are resolved faster from a local cache.

Update, I ran the DNS test at Cloudflare Browser Check and my Firefox browser passed all 4 of the tests. So Secure DNS on Firefox seems to be working as advertised.

Test results here —> https://imgur.com/a/i5L7rMp

So if my DNS is now secure, and my traffic is going over HTTPS, is that kind of equivalent to using a full blown VPN?

How can I determine the location of the 1.1.1.1 DNS server Firefox is using?

Just use the cloudflare, not the other one. Quad9 is also a great option.

Not sure how to determine location of DNS queries on desktop, but for Android I use a program that shows country flags for DNS queries and found out I was using far away as well as close servers, and couldn’t use just one as it was somehow the same original IP address, but accoriding to the icon, going to two different places. Actually it was ip 4 getting to a local ipv6 address, but then would also use a far away server.

So I didn’t like that at all, and went back to regular dns. A lot of times I don’t really care if it is encrypted, and that slows it down or just requires more processing. HTTPS is enough for hiding page content from anything trying to read it.

What I enjoy setting is software that blocks websites / dn requests so it saves wi-fi congestion and leaves more bandwidth and air-time for others using the network.

I like to believe that it also helps reduce energy use, but I doubt the changes I make are significant enough to make a difference. But if lots of people blocked the samw e network requests I do, I think it would reduce energy use.

It’s almost the equivalent of not enabling wi-fi, because if you run Wireshark or some firewall software on android that shows dns, or, set up a section of the network where the devices you use go to a gateway first that is under your control, you will see just how much junk connects as soon as it gets to the main network’s router.

Phones, Windows, Xbox, Roku, etc, lots of network activity, with zero user interaction, just enabling network or power on. On Windows, I allow just enough to update, including the traffic shaping for updates.

Windows still says “no internet” until I go to github, now owned by Microsoft, until I can use MY computer the way I want to.

If I could set Firefox to use standard dns separate from Windows, I could have Firefox be the only bit of software that is able to resolve network addresses.

I used to do this with Roku, but after a while, it jumps past my “router” dns (setup with Windows ICS, quite a useful feature) and goes to quad eight to bypass my setup. So who knows what else it’s doing, especially since I’m sure it’s against the TOS or EULA to inspect the data collection packets that get uploaded.

So I gave up on that, and it bothers me because there is so many domains loading, including two apps that pre-load. Especially Netflix, where they have said if the program is in-active for a month they’ll close the account.

That’s such a waste of electricity, I rarely go to that service, but some of the documentaries are exceptional, such as bands.

Stuff like that, if eliminated from all devices now and future, would save quite a bit of electricity. Why does roku need its own time server domain? Aren’t there enough of those already?

Some websites have like 50+ things load. I accidentally browsed a news website forgetting I had turned off NoScript, and that page was just too much. I looked at the network logs and counted at least 60 separate domains loading.

Many commercial websites have over 20 different domains load, many of which are to track you and later those same domains on other pages show you ads related to the pages you visited.

If all of that could be shutdown, we could probably cut the overall electricity used by all of the Internet by 10 or 20%.

The issue with NoScript is that it must load the list of requested domain names, I’ve seen the network activity in Wireshark even though it’s set to block everything by default. So an even more effective solution is to block all of those domains before they are loaded by noscript.

It may be useful to run pi-hole in a virtual machine and initially set it to use a wildcard for the blocklist.

Then search in the list for every website name you want to load, allow those.

Then if needed send all unwanted websites to the blocklist if they are not already set there because of the wildcard.

Or, set your gateway to an unused IP and let programs load. Block what you can, set a usable setup again and repeat. Wouldn’t work at all with websites, still have to block all unwanted domains one by one.