How your ISP tracks you (even with encrypted DNS)

Encrypted DNS (DoH, DoT, DoQ) does not fully protect your privacy from ISPs and network observers. Even with encrypted DNS enabled in Chrome or Firefox, the TLS Client Hello message exposes the Server Name Indication (SNI) field in plaintext, revealing which domains you visit. Using Wireshark with a network tap, this is demonstrated live against major sites like Nvidia, Microsoft, Cisco, and ChatGPT. Encrypted Client Hello (ECH) via Cloudflare can mask SNI for some sites, but many popular sites don't implement it, and even ECH-protected sites can leak domain info through third-party requests. IP address visibility is another residual leak even when SNI is hidden. Only a VPN (demonstrated with ProtonVPN/WireGuard) fully hides domain and traffic information from network observers. The post also covers UK ISP data retention laws and the trade-offs of encrypted DNS in enterprise environments.