September 4, 2026
The DNS Resolver Your AI Copilot Uses Without Asking
You spent years pointing DHCP at a recursive resolver that logs, filters, and validates DNSSEC. Then someone installed a coding agent. The agent speaks DoH to a public anycast you did not choose, resolves internal names into NXDOMAIN, and hands a model a list of destinations your proxy never saw. The model is not the leak. The resolver is.
Who is answering the name
Every stack now has a private DNS story: OS DoH, browser DoH, agent runtime, container sidecar. Look up the resolver address the same way you look up a website. IP Lookup should show an ASN you can name — your company, your filtering vendor, or a public operator you accepted in writing. An ASN you cannot pronounce is not “privacy.” It is an outsourcing decision made by a product manager you do not employ.
What breaks when the copilot picks DNS
- Split-horizon names for intranet apps fail, so the agent “helpfully” uses the public site.
- Security filters never see the query, so their dashboards look calm while the model reads staging.
- Geographic answers change. The agent lands on a different API PoP than the browser. Then someone files “AI is slow.”
Homes are not innocent
A kid’s homework bot and a cheap Android “AI browser” will set Private DNS to whatever the APK baked in. That resolver sees every name on the handset. Confirm it. If the origin is a hosting ASN in a country you do not do business with, remove the app. Do not argue with the settings screen — argue with the routing table.
A policy that survives agents
Pin encrypted DNS at the gateway for IoT and guests. Pin it by enterprise policy on laptops. Publish internal zones to the same recursive service the agents are allowed to use, or accept that agents will not see the intranet. When an incident mentions a strange domain, look up both the domain’s address and the resolver that handed it out. RDAP plus origin ASN is the smallest useful pair.
Look up your configured resolver and the one the agent actually queries. If the ASNs differ, your DNS policy is a suggestion.
FAQ
Is public DoH automatically safer?
It is safer against a hostile café. It is not safer against a resolver operator you did not pick. Safety is who you called, plus DNSSEC validation.
Can I block DoH ports and win?
You can annoy it. Many agents will fall back or tunnel. Policy on the device beats port folklore.