In most cases, using an anonymized Cloudflare's 1.1.1.1 DoH resolver is fine, and I trust it more than Google. That way, my ISP, corporate, coffeeshop, etc, will NOT be able to see or modify my DNS requests. What I personally prefer to use is a system-wide DNS resolver (such as Unbound or DNSCrypt-proxy) that upstreams to an encrypted server, preferably one that I run with my custom blacklists and whitelists. flags: qr rd ra QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 >HEADER<<- opcode: QUERY, status: NOERROR, id: 46609 $ dig > DiG 9.11.9 > global options: +cmd In this case, if I'd like to browse YouTube, I expect to get the IP address of Google servers, not the private-range address 10.10.34.35, which is simply returned by my ISP! :( Please see what an unencrypted DNS is returning for `` in my country: (click to expand) However, in my opinion, the alternative should NOT be to simply disable DNS encryption, since now the ISP (or corporate) will be able to eavesdrop and/or spoof my DNS requests, especially those that are not hardened with DNSSEC. , which is one of the domains Google uses to serve advertising). My personal reason being that I will lose control over the DNS responses, such as blocking Adware and Malware (e.g. Personally, I don't believe in each browser using a separate encrypted channel to relay the DNS requests, especially when they default to either Cloudflare or Google DNS. The use of this domain is specified by Mozilla, as a limited-time measure until a method for signaling the presence of DNS-based content filtering is defined and adopted by an Internet standards body.

I agree that the way Mozilla is currently handling DoH on their browser is not optimal, however as they have stated, this is meant to be a temporary measure until a proper method to signal the browser is standardized: Since you brought this issue up, I'd like to also mention some of my opinions regarding this matter as well.

Simple dns plus dns blacklist