Encrypted DNS still tells an eavesdropper where to look

This research study demonstrates that plaintext packet headers and monotonic counters leak information that allows an eavesdropper to identify DNS flows for IoT devices even when DNS is encrypted; classifiers achieved roughly 77–86% accuracy across scenarios. The authors propose header elision (peer-based SCHC rules and small CoAP block sizes), sequence-number/address obfuscation, and timing obfuscation to reduce leakage, and they publish their corpus and code for further study.