I don't want my family to get malware from sketchy websites. Quad9 offers a simple solution for these usecases. I'll take the false positive anyday over unfiltered DNS.
That might not be an issue for your situation, but I recall the benefit of something like Quad9’s offering is the encryption between client and their endpoint(s), particularly for untrusted ISP or similar.
Downside is Quad9 can see all your DNS traffic. But without it if you run your own recursive resolver your ISP sees all your queries, and many others see portions of them, unencrypted.
This hopefully shouldn't be an issue for long with stuff like RFC 9539 and OOTS/SVCB.
Used to be fine. I stopped doing it when average TTL dropped to 300 seconds and it takes far too long for my local recursor to get the answer >100ms, when 3rd party resolver delivers in <10ms.
cache-min-ttl: 3600 // seconds
cache-min-negative-ttl: 3600 // seconds
serve-expired: yes
serve-expired-client-timeout: 20 // milliseconds to wait for resolution before serving the old value to the clientFrom AT&T fiber, Cloudflare’s 1.1.1.1 is always the fastest, though Quad9 is a very close second.
It’s interesting that it’s different from different ISPs.
It can, it depends on the systems and user patterns. Example: if an end user is going to the same site over and over, those DNS responses are probably cached locally on the device, and may also be cached on any upstream resolvers. OTOH if you were somebody without a Facebook account that went to Facebook.com to view a post from a link, you could easily have 120 different DNS lookups for various resources on that domain that haven't been DNS or web resource cached yet.