Totally agree there.
Root DNS servers would not answer your computer's (stub resolver's) _recursive_ query. You do need a recursive resolver to do that - whether ran by an ISP or by yourself.
Honestly interested here.
DNS is very easy to run yourself. I use, and highly recommend, Unbound[1] as a caching resolver, and NSD[2] as an authoritative nameserver.
A caching resolver is used for ordinary lookups. If the address for "ycombinator.com" isn't in the cache, the resolver starts at the root and recursively finds the authority for the domain, gets the answer, caches it, and returns it to you. You run this for general usage, and you point your desktop/laptop computers to this address. Google runs their public resolver at "8.8.8.8", etc.
An authoritative nameserver is the ultimate authority on the lookup results for a specific domain. All lookups by other people eventually reach the authoritative nameserver for an answer. You run this for domains that you own, and configure it in your domain record.
(Both can be a bit more complicated than that, but they don't need to be)
These two services need almost zero care and feeding. Set them up once, and you can basically forget about them for years. This article only discusses resolvers, which are literally set-and-forget. Authoritative nameservers only need maintenance if you make changes to your domain. (And if you don't have your own domains, you don't need an authoritative nameserver at all).
[1] Unbound: https://www.nlnetlabs.nl/projects/unbound/about/
I have been using this program on all my computers, during the last almost twenty years, without problems.
https://www.internic.net/domain/named.root
This Ansible role takes care of configuring it all (CentOS):
https://github.com/liv-io/ansible-roles-centos/tree/master/u...
I have it for FreeBSD and OpenBSD too:
https://github.com/liv-io/ansible-roles-bsd/tree/master/unbo...
No matter what you do locally (unless you locally serve the do-not-auto-doh flag), you'll have to touch each of your browsers on each system to not have this behavior.
What a ton of people don’t understand is that you don’t need a DNS forwarder (google/cloud flare/ISP).
If you setup your DNS right it just goes to the ROOT servers and you cut out those parties spying on DNS traffic.
Initial requests are a bit slower because you don’t benefit from the forwarder’s cache, but after a while, most stuff is coached and it’s not a big deal.
Maybe I’m totally wrong here, but this is how I understand it.