What your ISP can see with default settings

  • Every DNS lookup in plaintext — every app and site you open, including ones you only type and never visit.
  • Connection metadata — destination IPs, session times, durations, volumes.
  • Traffic class — streaming vs gaming vs VoIP signatures, used for throttling decisions.

In many countries this metadata is retained by mandate, shared with partners, or sold to data brokers. It also leaks to whoever operates the Wi-Fi you join — hotel, office, airport.

Step 1: Encrypt resolution (the big one)

Encrypted DNS removes the richest single record: the domain list. Android has this built in for DNS-over-TLS — Settings → Network & Internet → Private DNS → provider hostname such as one.one.one.one. For DNS-over-HTTPS, which wraps queries inside ordinary web traffic and resists interception far better, use a firewall like NULLOG that implements DoH client-side with Cloudflare, Quad9 or your own endpoint. Your lookups become unreadable to the local network.

Step 2: Cut the secondary leaks

  1. Block telemetry at the source. Many apps send usage analytics to third parties who correlate with ISP-side data. Filtering firewalls strip those beacons before they leave the device.
  2. Avoid plaintext fallback. Verify with a DNS-leak test (NULLOG shows "0 DNS leaks detected" in its Encrypted DNS tab) — some devices silently fall back to port 53 when the encrypted resolver fails.
  3. Keep resolution local. With on-device filtering, the blocklist decisions never require a remote resolver either — one less party in the path.
Wi-Fi reality check: encrypted DNS protects you on hostile networks too — the café router can log ports and volumes, but no longer domain names. That is the exact scenario where it pays off most.

What still reaches your ISP

Honesty time: your provider still sees destination IP addresses and traffic volumes — enough to know you are talking to a video CDN, not enough to know which page. Fully hiding connection metadata requires routing traffic through an intermediary (a VPN or Tor), which reintroduces the trust question from our VPN comparison. Most users are well served by the 90% solution: encrypted DNS plus telemetry blocking, which eliminates the useful surveillance record while adding zero latency.

Put it into practice with NULLOG

NULLOG runs every technique in this guide locally on your Android — ads, trackers and telemetry filtered in device memory. No root. No cloud. No logs.

Download NULLOG APK (v1.0.2)

🛡️ VirusTotal Scan (0/73 Clean) ↗

Explore the full feature tour ↗