"Users can switch to Google's DNS if they wish to benefit from DNS over TLS."

"If a different DNS service provider you decide to connect to does opt to enable DNS over TLS, they'll get your DNS traffic instead of your ISP. DNS requests will be encrypted, but the DNS over TLS server still gets to see your DNS traffic, though that alone might be a step above using your ISP's servers without TLS over DNS. At least this way, your ISP won't be able to attach your queries to the IP you've been assigned, and thus your name."

Author makes a plug for a third party DNS provider. Third party DNS provider also happens to sell web ads and data about users.

Author believes letting Google or other third party DNS provider see queries is "step above" letting ISP see them.

Assuming this is true (to avoid needless arguments) but wanting more, is there a "step above" letting a third party DNS provider log the queries?

IMO, yes, an obvious one. Running DNS cache and/or authoritative daemons on localhost. Using a custom root.zone can be helpful.[FN1]

Is that possible on a mobile phone? No idea. Maybe it should be.

Any other options? How about running a cache and/or authoritative daemons on a computer you can actually control. Set the mobile OS DNS settings to point to that computer. It works. I have been doing this for many years.

FN1. Per packet encryption for DNS is also available via DNSCurve. For example, I can make encrypted queries directly to the DNS servers for any website that support it. I have been using DNSCurve for years as well. It works. Only a small number of public websites have adopted it so far even though it is relatively easy to set up.

Although I personally do not care for third party recursive DNS service, third parties might provide a useful name lookup service over TLS. To illustrate, we can use Google DNS is an example.

What if we could make queries over TLS (using HTTP) but without using SNI?

To start, get the IP address for the third party provider.

dig dns.google.com

Let us assume hypothetically the IP address is 1.2.3.4

curl https://1.2.3.4/resolve?name=example.com.\&type=dnskey

Assuming this service is still working you should receive a DNS packet as JSON.

The reason why I think this could be useful is that we can use HTTP pipelining to the http daemon. Example below. (No publicly available dns daemons accept pipelining AFAIK.) Thus one can do multiple lookups by sending only a single TCP packet.

I have never understood is why there are no publicly released DNS servers that can accomodate multiple queries in a single UDP DNS packet. If I recall correctly, the original DNS RFC contemplates this.

The DNS data returned via TLS (as JSON in the Google DNS example) might be useful for instance in emergencies when DNS service is unavailable or untrustworthy, or it might be inserted into HOSTS file or into custom zone files served by localhost daemons. It could be useful.

openssl s_client -tls1_2 -ign_eof \
-connect dns.google.com:443 -verify 9 <<eof
GET /resolve?name=example.com.\&type=dnskey HTTP/1.1^M
Host: dns.google.com^M
Connection: keep-alive^M
^M
GET /resolve?name=example.net.\&type=dnskey HTTP/1.1^M
Host: dns.google.com^M
Connection: close^M
^M
eof