zlacker

So if we're talking just about unencrypted DNS to 1.1.1.1 then you're assuming an entity capable of sitting in front of us in 194 cities worldwide.

vs

With EDNS sitting in front of the authoritative server of the site this actor is trying to monitor.

The latter is easier than the former.

>>jgraha+(OP)
In the latter case it's just as easy to catch real IP addresses by sitting in front of authoritative DNS servers and actual servers those DNS records point to. As I said, you just can't justify it as a privacy feature. It does nothing significant in any threat model.