Before your browser loads a single page, it asks a question: “What’s the IP address for this domain?” That question is a DNS lookup, and it happens for every site, app, and background service on your devices — often hundreds of times an hour. The trouble is who’s listening.

The quiet leak

By default, your DNS lookups go to whichever resolver your ISP or router hands you — usually the ISP’s own. That gives them a running list of every domain you touch: the sites you read, the apps you open, the services running on your phone at 3am. Even when the connection itself is encrypted with HTTPS, the DNS question that kicked it off frequently is not.

It’s one of the most underappreciated privacy leaks out there, because it’s invisible and constant.

Enter Pi-hole

Pi-hole is a small, self-hosted DNS server — it runs happily on a Raspberry Pi or any spare machine on your network. Every device points at it, and it does two useful things:

1. Blocks trackers and ads at the network level. Requests to known advertising and tracking domains are dropped before they ever leave your network. Every device benefits — phones, TVs, IoT gadgets — with no app to install on each one.
2. Gives you visibility. You can finally see how chatty your devices are, and which domains they phone home to.

A sensible starting setup

• Run Pi-hole on a device that’s always on.
• Point your router’s DHCP at it so every device uses it automatically.
• Add a reputable blocklist or two — start conservative to avoid breaking sites.
• For the DNS-is-not-encrypted problem, pair Pi-hole with an encrypted upstream (DNS-over-HTTPS or DNS-over-TLS) so your lookups are private in transit, not just filtered.

That combination — filtering locally, resolving over an encrypted upstream — closes the leak from both ends.

---

We’ll publish a full step-by-step Pi-hole guide soon. Until then, subscribe via RSS to catch it.