The good thing about dnsdist is that it acts as a sort of load balancer for DNS queries and offers features such as dynamic blocking (including via eBpf) at the IP level and rules and rate limits for query types you can combine. Therefore, there are no limits (or very open limits) for all query types from whitelisted IPs, and stricter rules for all others. IPset and GeoIP banning of known malicious IPs and regions (using block-lists) also keeps the footprint of "unwanted" use very, very small.
Nothing prevents the ISP from collecting that.
I know some (all?) EU advertisers deny creatives based on optics i.e. "our name and logo is on the billboard frame, we don't wanna get associated with topic X".
I know just about everyone at my ISP. I know where many of them live. We all live in the same small tight knit community. They tried really hard to get me to join their network team.
It's just a "me" thing. Others can and should do whatever they think will work for them. If everyone does this a little different that is probably best.
And I've got a little tool that takes:
ayt7.ads.acme.com
afi6.ads.acme.com
foi5.ads.acme.com
ads.acme.com
mybank.com (legit)
myb4nk.com
mibank.com
mybank.{any other tld}
I generate hundreds of thousands of such variations: all blacklisted by unbound.
I did it after one of my bank sent me an example of a very convincing phishing site.
Been using such a setup since years now. A million blocklisted domains runs fine on an old Pi 3. I take it that on a more powerful computer unbound can deal with blocklist with millions if not tens of millions of domains (and, no, I haven't moved to whitelisting only).
I also block all unicode domains. I simply cannot access a domain name that use unicode characters in its name (and, no, I don't care).
How does this look? Shell script querying a list of hostnames? What qualifies as a domain you use?
[1] - https://nochan.net/b/Internet-Crap/20260602-Set-Up-Your-Own-...