Whether netflow is heavily sampled or not depends on where and how it is generated and for what purposes. It's just a format.

> You started out saying that running your own local recurser is privacy-enhancing (it's the opposite) and that ISPs can see your DNS queries when you run DoH (they can't) and retreated to a position of "other things leak".

Never said any of that, but your remarks are still wrong. What I said is basically that at ISP level there is much more information about what you are doing than DNS queries, including information that allows to identify the websites you are visited. Again, just IP addresses alone identify more than 90% of websites (can't remember the exact number from the research, it's like 95% from alexa top 1 million).

Now with regards to privacy. First it's important to understand what privacy is actually about. Within your traffic there is a lot of meta and side channel-like information, some of the sources of that information overlap a lot or are even identical, a lot of redundant information. Like we can look at a packet with a DNS query and see domain name identifying a website. Or we can look at IP address of a packet initiating new connection, it won't identify every website uniquely, but it will most of them, to get to 95% we would need to also look at IP addresses of new connections following that connection, i.e. sub resources, making sort of an IP set fingerprint, either way single IP addresses or a fingerprint can be mapped to unique domains or a set of potential domains. To complete this example there is also SNI in plain text in packets and domain names in Host: headers, which also uniquely identify websites. So there is at least 3 sources of the same or almost the same information. What kind of privacy level is that? Well, we have a single party with access to the same relatively easily extractable information from multiple redundant sources, it's a lot to trust with. Would it change anything if remove any of the sources? Not really, it would have very insignificant effect on privacy since other sources are still available. And if we have to send that information to another party, now that would make things much worse, because now we would have to trust two parties with the same information, rather than one. Ok, so, how can we actually improve it? We can try to remove all three sources of information and send all of them through another party. This changes the party we have to trust, but we still have to trust it with just as much. What if we can't trust any party that much? Then the next choice is to shard (partition) that information to as many parties as we can. Trusting even just with half of that information to one party and half to another is already much better and is where we finally start scratching the surface of privacy. I hope it's clear that DoH is not helping with privacy, it just steals one of the sources of this information.

As for running local recursive DNS server instead of the one provided by an ISP, it isn't leaking significantly more information to anyone. Packets likely go through the same route and there is a bit more of them for queries that didn't hit the cache for few popular domains. IP address is also exposed in such DNS packets, but ISP's DNS server would be coming from an IP address that belongs to the same AS and this leaks almost the same amount of identifying information.