DNS privacy explained: who sees every site you look up
Before your browser loads a page, it asks DNS where that site lives. Those lookups reveal your browsing to whoever runs the resolver — here is how encrypted DNS changes the picture.
DNS is a diary of your browsing
Every domain you visit starts with a DNS query: a plaintext question asking which IP address belongs to that name. By default that question goes to your ISP's resolver or your network's configured server, which means your provider can log a near-complete list of the sites you visit.
This happens before any HTTPS protection kicks in. Encryption protects the page content, not the lookup that found the page.
What encrypted DNS (DoH/DoT) changes
DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) wrap those questions in encryption between you and the resolver. Your ISP then sees only that you contacted the resolver — not which names you asked about.
The tradeoff is trust placement: the resolver you choose still sees everything. Switching from your ISP to a privacy-respecting resolver moves the trust, it does not eliminate it. A VPN adds another layer by hiding even the resolver traffic from your local network.
What your browser can and cannot tell you
Here is the honest part: a web page cannot read your system DNS settings. No website can list your configured resolvers or prove which encryption your OS uses. Any tool claiming otherwise from pure JavaScript is guessing.
What a browser can do is test reachability heuristics and teach you where to look. Run the DNS privacy check on this site to learn your browser's encrypted-DNS settings path, then verify the OS-level configuration yourself in the guides linked below.