INCOGNITO hides nothing from these 3.

incognito mode is not the privacy blanket you think it is

incognito mode (or "private browsing" if you're on firefox) stops your browser from saving history, cookies, and form data on that specific browser. that's it. that's the whole job. it was never designed to hide what you're doing from your own operating system, your router, or your isp. a lot of people treat it like a cloak of invisibility and it's really more like clearing your search history off one app while the phone still knows everything.

one of the easiest ways to prove this to yourself is checking your windows dns cache. every time your computer visits a website, even in incognito, it has to look up that site's ip address using dns. windows keeps a local cache of those lookups so it doesn't have to ask again right away. incognito does not clear that cache. so the record just sits there.

the command

ipconfig /displaydns | findstr Record

let's break this down piece by piece.

ipconfig /displaydns dumps everything currently sitting in your local dns resolver cache. this includes every domain your machine has resolved recently, incognito or not, because dns lookups happen at the network stack level, not the browser level. the browser doesn't get a say in this.

| this is a pipe. it takes the output of the first command and feeds it into the next one instead of just printing it to the screen.

findstr Record findstr is windows' basic text search tool, kind of like grep on linux. filtering for "Record" trims the wall of output down to just the lines showing record names, which are the actual domain names that got looked up. without the filter you get a ton of extra formatting noise like ttl values and record types that make it harder to scan quickly.

run it after some "private" browsing and you'll see domain names sitting right there in plain text.

why incognito can't stop this

incognito mode operates at the application layer. it controls what your browser writes to disk: history, cookies, cache, autofill. dns resolution happens below that, at the os and network layer, before the page even loads. your browser asks windows "hey what's the ip for this domain" and windows either checks its cache or asks a dns server. that lookup gets logged locally regardless of which browsing mode you're in, because the browser never controls that process to begin with.

same story applies to your router, your isp, and any dns server you're pointed at. incognito hides your activity from someone else who uses your computer after you. it does basically nothing against anyone who controls the network or the machine itself.

who should actually care about this

if you're worried about a family member checking your search history, incognito is fine for that narrow case. if you're worried about your employer, your isp, or anyone with access to your network traffic or your device, the dns cache is one of several places your activity is still sitting in plain view. this matters for anyone doing a security check on a shared or work laptop, or anyone auditing what a device has been talking to.

how to check and clean your own machine

run the command above to see what's currently cached. if you want to clear it out:

ipconfig /flushdns

on linux, dns caching behavior depends on your setup (systemd-resolved, dnsmasq, etc), so check what's running with:

resolvectl statistics

for real privacy, the fix isn't hiding the cache after the fact, it's controlling what leaves your machine in the first place. a few actual defenses:

use encrypted dns. dns-over-https or dns-over-tls stops your isp and anyone snooping the network from seeing your plaintext lookups. most modern browsers support this natively in settings.

use a trustworthy vpn if your threat model includes your network operator or isp, not just your roommate.

periodically flush and check your own cache as basic hygiene, especially on shared or work devices you don't fully control.

the takeaway

incognito mode does one job well: it keeps your browser from saving stuff locally in that session. it was never built to hide dns traffic, network logs, or anything happening outside the browser itself. knowing where the actual gaps are, like the dns cache sitting in plain text on your own machine, is what lets you close them instead of trusting a checkbox that was never meant to protect you from that.