My House Was Whispering to Strangers

Here is something we don't think about. Before your phone loads a page, streams a song, or silently phones home in your pocket at 3 a.m., it asks a question first: "where is this?" It takes a name a human can read and asks for the number a machine can reach. That's DNS — the Domain Name System — and it happens thousands of times a day, per device, in a home full of devices. It is the most-used system almost no one ever sees.

I like to think of DNS less as the internet's phone book and more as its diary. A phone book is neutral. But a running list of every name your home looks up — every app the moment it wakes, every site before you've finished typing, every smart bulb and TV and watch reporting in — that isn't a phone book. That's a record of intent. It's what you're about to do, written down a half-second before you do it. And whoever answers those questions gets to read the diary.

For years I told myself I'd taken care of this. I had the popular ad-blocker running on a little always-on box in the corner. A tidy dashboard. Graphs. I felt like a responsible adult who had Handled It.

The scarecrow

One slow evening I actually looked — not at the dashboard, but at where the questions were really going. And the number that should have been near the top was near zero.

Almost nothing in my house was going through my blocker. The router — the thing every device trusts by default — had quietly been doing what routers do out of the box: taking every question and forwarding it, unblinking, straight to a pair of enormous public resolvers run by exactly the kind of companies I'd set the blocker up to keep at arm's length. My careful little box in the corner was a scarecrow. It stood there looking authoritative while the whole field walked around it.

Setting something up is not the same as being in control of it. I knew that as an engineer. It's humbling to learn it again as a resident of your own house.

That's the part I want this to be about, because it's the part the tutorials skip. This isn't a story about installing software. It's about the difference between the appearance of control and the real thing — and how much quiet work lives in that gap.

Two jobs, and the one everybody skips

When people talk about this setup, they usually mean two pieces of software. It took me a while to understand they do genuinely different jobs, and that the famous one is not the important one.

The famous one is the bouncer. It holds a very long list of names known to belong to ads and trackers, and when a device asks for one, it simply says "that address doesn't exist" and the ad never loads. Satisfying. Visible. It's the reason most people show up.

The one people skip is the resolver — and it's the whole point. Blocking a bad name is good. But every good name still had to be looked up somewhere, and by default "somewhere" means asking a stranger's server to go find the answer for you. You've cleaned up which questions get asked, and left who answers them exactly as it was.

The fix is a small, unglamorous program that does the looking-up itself. Instead of handing your question to Google or Cloudflare and trusting whatever comes back, it starts at the top — the internet's root servers — and walks the chain down, hop by hop, asking the authoritative source for each name directly, and remembering the answer.^[1] It is called a recursive resolver, and running your own changes the shape of the whole thing:

Before:  every device  →  my router  →  a stranger's resolver  →  the internet
                        (they see every question)

After:   every device  →  my router  →  my blocker  →  my own resolver  →  the roots, directly
                        (no stranger in the middle)

There's a second gift hidden in there, called DNSSEC. It lets a resolver check that an answer really came from who it claims to, unaltered in flight — cryptographic proof against someone quietly slipping you the wrong address.^[2] When my resolver returns an answer it has verified this way, it stamps it as authenticated. The first time I watched that little stamp appear on a lookup my own machine had reasoned out from the root, I felt something I can only describe as tenancy — like I'd stopped renting this part of my life and started owning it.

Control is a fence, not a switch

I thought that was the finish line. It was the start.

Because here's the thing nobody warns you about: your own devices cheat. Not out of malice — out of design. A surprising number of gadgets don't ask politely and accept your house's answer. Some have a public DNS address hard-coded into their firmware and try to reach it directly, ignoring your setup entirely — a TV, a phone OS, a random smart plug, all quietly routing around you. Others have moved to encrypted DNS, wrapping their questions inside ordinary-looking web traffic specifically so networks like yours can't see or redirect them.

So "being in control" turned out not to be a setting I could switch on. It was a fence I had to keep mending. Catch the devices dialling out to hard-coded strangers and gently insist their questions come home instead. Close the encrypted side-doors that exist for the express purpose of escaping. Notice the next gap and close that too. It is quietly adversarial, in your own home, against things you paid for. There's a strange intimacy to it — learning the little dishonesties of every object you own.

I grew up around the idea that the things you depend on should be things you actually keep — mended, tended, yours. This is just that idea, in packets.

The humility clause

And then the last lesson, which is the most important and the least glamorous.

Once every question in the house flowed through my one little box, that box became the single thread the whole home hung from. A power cut, a failed update, a kernel deciding to sulk — and suddenly nobody can reach anything, because nobody can look up a name. Total control has a failure mode, and its name is total.

So I did something that felt, at first, like a betrayal of the whole project: I built in a fallback to a big public resolver — the exact strangers I'd worked to cut out. But I made it strict: my own resolver first, always, for everything; the stranger only ever reached for when my box is genuinely unreachable, and dropped the instant it comes back. Filtered and private when I'm up; merely working when I'm down. The ads slip back in for those few minutes, and I decided I can live with that far more easily than a house that goes dark because I insisted on doing everything myself.

That felt like the real graduation. Not the recursion, not the crypto stamp — the moment I chose, deliberately, when to loosen my own grip. Control that can't bend just breaks. The maturity is in knowing exactly where you'll compromise, on purpose, before reality forces the question.

What actually changed

The ads went away, sure. That's the part you can screenshot. But that was never really it.

What changed is quieter and harder to point at. Now, when my home turns to the internet and asks where something is — thousands of times a day, in the background, while I'm asleep or cooking or not thinking about it at all — the question stays home first. My own machine reasons it out, from the root, and keeps the diary. No stranger in the middle, most of the time, by my choice, on terms I set and mend and occasionally, knowingly, relax.

The best infrastructure is invisible. You forget it's there. The only difference now is that when I do remember — some slow evening, looking not at the dashboard but at where the questions really go — the answer is me. That turns out to be worth an evening's work, and then a lifetime of small mending. Most things worth keeping are.

I left the coast to build systems out of software. This is a small one. But it's mine, end to end, root to leaf — and I understand every hop. That's the whole reason I do any of this.

---

Notes & further reading

I've deliberately kept my own network out of this — no addresses, no map, no config. If you want to build your own version, start here, from the people who actually make these tools:

1. Pi-hole's official guide to pairing it with a recursive resolver — "Pi-hole as All-Around DNS Solution" (docs.pi-hole.net). And the resolver itself, unbound, from its makers at NLnet Labs — nlnetlabs.nl.
2. What DNSSEC is and why the "authenticated" stamp matters — ICANN's explainer, "DNSSEC – What Is It and Why Is It Important?"
3. The blocker, if you're new to it — Pi-hole. Everything above is possible with entirely free, open-source software and a very modest always-on machine.