Encrypted DNS still tells an eavesdropper where to look