alt Hacker NewsYou should be NATing outbound 53 to a local resolver that upstreams to DoH/DoT. Relying on such an opt-out is rather optimistic.
You should be NATing outbound 53 to a local resolver that upstreams to DoH/DoT. Relying on such an opt-out is rather optimistic.
I don't use their resolver at all. Their opt-out was more of an all-encompassing "let us take whatever data we can manage to get" than DNS specifically.