Comment by vhcr

Unless you're using DNS over HTTPS they can see the unencrypted DNS traffic. There's also Encrypted Client Hello, but they can also see which IP you're connecting to.