Plus, the plaintext DNS is rarely altered, with even NXDOMAIN hijacking* being rare these days. Usually it's just collecting for ads or basic malware detection

Plus, the plaintext DNS is rarely altered, with even NXDOMAIN hijacking* being rare these days. Usually it's just collecting for ads or basic malware detection. Or content filtering depending on the provider. *where instead of returning the proper "name not found" DNS error, the recursive server redirects to a site owned by the provider to show ads. Not to be confused with typo squatting where domain speculators register domains showing ads hoping people mistype URLs.