The Domain Name System (DNS) is a fundamental component of the Internet, yet its resolution process exposes highly sensitive information about client activity. DNS resolvers, positioned between clients and authoritative name servers, typically observe both query contents and client identifiers, making them a focal point for privacy risks and a natural target for privacy-enhancing mechanisms. This thesis investigates privacy challenges involving DNS resolvers and analyzes how proposed technical solutions are deployed and implemented in practice.

The thesis adopts an empirical approach, using active and passive Internet measurements from multiple vantage points to study resolver behavior. The results show substantial growth in the adoption of DNS privacy mechanisms such as Query Name Minimization (QMIN), largely driven by defaults introduced by major public resolvers. However, adoption remains uneven across regions and resolver types, and persistently low for mechanisms enabling encrypted resolver discovery among non-public resolvers.

We identify significant deployability challenges: strict QMIN configurations cause resolution failures, increased latency, and higher traffic overhead due to widespread misbehavior by authoritative servers, while DNS resolution over the Tor anonymity network provides strong anonymity guarantees at the cost of reduced performance. The thesis further reveals systematic deviations from standards that enable fingerprinting of resolver software, as well as widespread misconfigurations in encrypted DNS transport signaling that reinforce resolver centralization. Overall, while privacy-enhancing DNS mechanisms are increasingly deployed, their real-world effectiveness is constrained by implementation gaps, performance trade-offs, and centralization pressures, highlighting the need for improved interoperability, validation tools, and greater attention to operational realities.