Bunny DNS is free, but your query is being priced

Every time you open a web page, the DNS query in the background of your mobile phone runs silently. At the end of the day, the number of such inquiries can easily reach thousands. Every query is made to the DNS server: Who you are, where you are, and what you are interested in. Bunny CDN's announcement that DNS services will be permanently free may sound like a boon for the Internet, but free DNS is by no means a charity. It is an entry point to monetize user query data, destroying the last fortress of privacy. Most people only see "free", but I see the price marked on the back of every DNS query you make-this is not conspiracy theory, but business that happens every day in the North American advertising technology market.

Show the cards first: Bunny CDN is not the first to do this, and it will not be the last. The free DNS track is crowded with commercial players, including Google's 8.8.8.8, Cloudflare's 1.1.1.1, Quad9, OpenDNS, and various ISPs 'own DNS redirection services. The difference is that Bunny's business model relies more nakedly on data monetization. Most free DNS services verbally promise to "not record" and "not sell," but there are always operational gaps hidden in privacy policies-"sharing anonymous data","using it for product improvement" and "optimizing services with partners." Bunny's privacy page makes it clear that collected DNS query data may be used for "trend analysis, content distribution optimization, advertising and marketing purposes." Pay attention to the last "advertising and marketing purpose", this is the real business account.

How much can DNS query data be exposed? Open it up and see it more private than browsing history. A complete DNS query log contains at least: timestamp, source IP address, query domain name, query type, DNS client fingerprint (such as EDS0 option, encryption suite), and even source port. These fields are put together to create a person's numerical behavior sequence. Check the A records of www.example.com at 2 a.m.; intensively visit certain sub-domain names under linkedin.com sleep.clinic DNS queries don't look at what is written on your webpage, but they know which neighborhood you are going to, which is earlier and more primitive than the intention revealed by the content itself. ****

This matter is not complicated, but many people are deceived by the word "free". The commercial ledger of free DNS is essentially exactly the same as free mailboxes, free maps, and free cloud storage: First take free services to absorb traffic, and then rely on user behavior data to support the advertising network and recommendation system. The difference is that the DNS data is located further upstream. Gmail scans email content, and Maps knows which restaurant you searched, but the DNS server sees a "directory" of all your digital footprints-it already knows where you are going before you open the web page. This priori makes it more valuable than any application-level data. Advertising networks are willing to pay high prices for "intention signals" because the conversion rate is highest when users are still planning behavior. A DNS query record, after cleaning, correlation, and modeling, can bid a price 3 to 5 times higher than ordinary Cookie data in the real-time bidding system.

Bunny CDN parent company BunnyWay d.o.o. Registration in Slovenia just avoids the strict constraints of GDPR. Although Slovenia, as a member of the European Union, is regulated by GDPR, its enforcement efforts and resources are far inferior to those of Germany or France. Bunny could have added a sentence to the privacy policy to "process data based on legitimate interests" and then continued to direct the query log to the data broker. I have checked the list of suppliers of several mainstream quantitative advertising platforms, and at least two of them have data cooperation with CDN providers in China and Europe. Bunny is not the first to take this path. Akamai, a veteran player in the CDN industry, provided "threat intelligence" products to Fortune 500 customers as early as 2015 by acquiring Prolexic and integrating DNS data services. That is essentially a commercial packaging of DNS query data. The difference is that Bunny has lowered the gameplay to the free level, using "permanent free" to build up the user base and data volume.

Some people would refute that free DNS services increase Internet speeds, lower access barriers for ordinary users, and many services explicitly promise not to record identifiable personal information. This privacy exchange is acceptable, users benefit, and the company earns advertising fees, a win-win situation. There are two things wrong with this refutation.

First, it assumes that users know what they are exchanging. The privacy cost of DNS queries is implicit, and users have no idea that they are being labeled as a "high-value advertising audience" every time they ping a domain name. No free DNS service will write in the installation guide: "Tip: We will record your query domain name to create a behavioral profile for you and use it for advertising." They hide key information in paragraph 12 of their privacy policy and obscure it with "improved services." This asymmetry of knowledge makes "free exchange" a unilateral harvest.

Second, DNS query data has an irreversible cumulative effect. It's useless for you to delete browsing history or clear cookies. Once the DNS log is recorded and associated, your identity can be restored across devices, networks, and timestamps. Someone has done an experiment and can use machine learning to distinguish 95% of family members based on just two weeks of DNS query time series data, which is accurate enough to distinguish who has chronic diseases and who is preparing to change jobs. Once this data flows into the data broker's black box, you can no longer withdraw it. This is not a privacy exchange, but a permanent demolition of privacy.

Look at this in a different setting. A woman who works as a real estate agent in Chicago, the first thing she does when she arrives at the company every morning is to turn on her computer to check the domain names of competitors, scan courses on the real estate school's website, and visit several real estate forums. Her company uses Bunny's free DNS because her boss thinks "it's the same anyway, fast and free." Three months later, she suddenly received a large number of advertisements on Facebook for "commercial loans","agency training" and "low-cost housing leverage". She thought her mobile phone was being eavesdropped, but in fact, All of her DNS queries-from the first day at work-had long been used to identify her professional identity and purchase intentions, packaged and sold to advertisers. This happens repeatedly in the Internet industry, but this time, the listener changed to a DNS server, and the user did not even have the opportunity to "clear the Cookie."

Let me make a bet: After Bunny CDN launches permanently free DNS, the next step will be to launch an "advanced analytics" platform to sell audience insights based on DNS queries to corporate customers. This is not speculation, but an inference based on the evolution path of the CDN industry. Cloudflare has Radar, Akamai has mPulse, and Fastly has Real-Time Analytics-these products all package aggregation layer data into business intelligence. If Bunny wants to survive in the Red Sea of CDN, free DNS is the drainage funnel, and data monetization is the profit engine. The business account behind technical decisions has never been "whether to make money", but "whose money to use."

Anyway, this matter is not unsolved. Technically, DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) can encrypt queries so that middlemen cannot see the content. But encryption only prevents eavesdropping on the network link, not the DNS server itself. As long as your query ends up on Bunny's parser, encryption is useless-it's naturally in plain text on the server because the parser needs to see the domain name to work. This is the dead knot: The DNS protocol was originally designed on the assumption that recursive resolvers are trustworthy, but the free DNS service provider is the least trustworthy party. You can switch to a paid NextDNS or ride your own Pi-hole, but ordinary users don't have this awareness or motivation. Therefore, free DNS like Bunny is destined to harvest the largest number of users, and ordinary people who need privacy protection the most are precisely the most fertile prey for data monetization.

Bunny DNS is free, after all, has nothing to do with technology, it is only about books. The growth of the CDN industry has peaked, edge nodes have become commodities, and differentiation can only rely on data and value-added services. Free DNS is the cheapest channel to get customers, and the commercial value of DNS query data far exceeds the cost of bandwidth. When a service is permanently free, you have to ask: Who is paying? What are you paying for? On Bunny's ledger, every time you press enter, you are saving an extractable asset in their database. The only difference is that the owner of this asset has never been you.

So don't be fooled by the word "free". The milliseconds of query latency you save will never keep pace with the speed at which your data is resold.