For three decades, DNS was the internet's biggest, loudest privacy leak — and almost nobody talked about it. Every web page you visit, every email you send, every app that phones home generates DNS queries that, until very recently, traveled across the wire as plaintext UDP, readable by anyone on the path. RFC 7626 was the document that finally said this out loud, named the threats, and lit the fuse on the encrypted-DNS revolution we're living through now.

Stéphane Bortzmeyer — a French DNS engineer at AFNIC and one of the IETF's most prolific privacy voices — wrote it as an Informational RFC. No new protocol, no new bits on the wire. Just a careful, methodical threat model. That modesty is the point: you can't fix what you haven't articulated, and pre-2015 the DNS community largely treated query confidentiality as somebody else's problem.

The RFC's core contribution is splitting the threat surface into two cleanly separated pieces:

• The stub-to-resolver path. Your laptop to your ISP's (or Google's, or Cloudflare's) recursive. Here the resolver sees everything: every domain, every timing, every device fingerprint via source port and TXID patterns. Bortzmeyer calls this "the wolf knows who the sheep are" — and notes that consolidation onto a handful of public resolvers makes the wolf bigger, not smaller.
• The resolver-to-authoritative path. Here each authoritative server sees only the queries for its zone, but the root and TLD servers see the leading labels of nearly every lookup on Earth. The RFC points out that a passive observer near a root server learns an astonishing amount about global browsing patterns.

From this taxonomy the document enumerates specific leaks engineers had quietly ignored: QNAME being sent in full to root and TLD servers that don't need it; EDNS Client Subnet (RFC 7871) leaking subnet info to authoritatives for "better" geo-routing; cache snooping via non-recursive queries; reverse DNS revealing internal network topology; and the now-obvious fact that "private" data like usernames embedded in hostnames (think userid.dropbox.com-style patterns) was being broadcast in clear.

What makes RFC 7626 historically important is what came after it. Once the threat model existed, the standards work cascaded:

• RFC 7816 — QNAME minimization. Only send the labels each server actually needs. Now default in Unbound, BIND, Knot, and most public resolvers.
• RFC 7858 — DNS over TLS (DoT), 2016.
• RFC 8484 — DNS over HTTPS (DoH), 2018, the one that got browsers involved and started the political fights with network operators.
• RFC 9250 — DNS over QUIC (DoQ), 2022.
• RFC 9076 — the formal update to 7626, refreshing the threat analysis after years of deployment experience.

The quieter consequence is architectural. Bortzmeyer's framing forced the community to admit that encrypting transport doesn't solve the privacy problem if you also centralize the resolver. The current debates around Oblivious DoH (RFC 9230), local resolvers, and split-horizon corporate DNS all trace their vocabulary back to the wolf/sheep distinction in this document.

It's a useful reminder that some of the most influential RFCs ship zero new bytes on the wire. They just teach a generation of engineers a vocabulary precise enough to fix a problem that had been hiding in plain sight since 1983.