[skuzye]

if the traffic is encrypted how can you tell whether it's http or plain dns?

[jedisct1]

Because the purpose of middle boxes is to log your traffic no matter what, usually by installing a root certificate on your devices.