> Everyone should just start running their own authoritative DNS servers like Unbound. I used to do that, but it caused some odd issues at my former ISP, which

> Everyone should just start running their own authoritative DNS servers like Unbound. I used to do that, but it caused some odd issues at my former ISP, which I suspect were due to connection tracking state table exhaustion on their CGNAT box; running your own recursive server means a lot of UDP connections, and unlike with TCP, there's no well-defined point at which the connection tracking state can be released, which can lead to it accumulating. Making unbound use DoT to cloudflare made things much more stable (since DoT uses TCP, the connection tracking state can be released immediately when each connection is closed).