Is it a bad idea to use VPN with a private DNS?

Privacy Questions
1

Hello everyone,

I’m exploring the world of online privacy and recently stumbled upon something intriguing. I’m not super tech-savvy, so I’d love your thoughts on this. I’ve been trying out RethinkDNS and it’s pretty neat. It combines a private DNS (DoH2) with a Wireguard VPN. However, I stumbled upon a guide that suggests it’s probably not advisable to use encrypted DNS alongside a VPN. This left me a bit puzzled.

Despite the guide’s advice, I see potential benefits in this setup:

  1. Beyond IP Addresses: It’s not just about hiding your IP. Encrypted DNS can also block trackers that compromise your identity.
  2. Reduced VPN Provider Visibility: By using a private DNS, I believe you can limit your VPN provider’s ability to monitor your DNS requests.
  3. Speed Improvement: It might improve Internet speed if your VPN server is far away.

I would greatly appreciate any insights or experiences you might share on this topic. Are there any technical aspects I’m overlooking? Your input will help not just me, but others navigating these complex privacy tools.

Thanks in advance!

1 Like
2

Well sure, to an extent, so long as those trackers are not being served by the same host as the one delivering content. Additionally, some VPNs (I use Proton and it has this feature) let you enable ad/tracker blocking when connected to the VPN

It doesn’t hide anything, you can always do reverse DNS lookups based on the IP addresses you’re accessing via the VPN connection if you really want to know what sites someone is going on

I mean, maybe? But then we’re just coming back to the point about adding extra entities to trust for minimal benefit.

2 Likes
3

Reverse lookups (PTR records) aren’t as effective in the age of CDNs and proliferation of Cloud computing (see: http://web.archive.org/web/20230322054558/https://files.research.cloudflare.com/publication/Fayed2021.pdf)

1 Like
4

For general browsing, yeah it’s harder. But if you’re doing something you want to hide, it’s likely that it won’t be via something that has a cdn

1 Like