I happen to run a public DoH/DoT content-blocking resolver, and we do see some apps / services bypassing user-set /network-set DNS with regularity these days. B

I happen to run a public DoH/DoT content-blocking resolver, and we do see some apps / services bypassing user-set /network-set DNS with regularity these days. But that's not even the bigger problem for DNS-based content blockers. These trackers can and do run under first-party domains these days: Ex A: https://blog.cloudflare.com/twilio-segment-sdk-powered-by-cloudflare-workers/ https://blog.cloudflare.com/twilio-segment-sdk-powered-by-cl... Ex B: https://developers.cloudflare.com/fundamentals/get-started/reference/google-analytics/ https://developers.cloudflare.com/fundamentals/get-started/r... Ex C: https://news.ycombinator.com/item?id=30411049 https://news.ycombinator.com/item?id=30411049