Millions of people in the US can't change their ISP. I live in a major city and would have to drop my speed by 90% if I switched to my other option. I have two options total.

Doesn't T-Mobile US offer home internet over 4G and 5G in most of the US now?

I've actually been using tethering for home internet, and it's often faster and cheaper than landline alternatives. Easily get 100Mbps in my location over 4G LTE on an old phone.

T-Mobile US is a funny example since they have been caught intercepting traffic for other DNS resolvers and silently responding with their own.

https://esd.io/blog/t-mobile-dns-hijack.html

I don't think I could make do with less than 1 Gb/s (currently gave 1.3).

I have a ton of home automation, a few HD cameras, and household members who stream video (or play games) basically 24/7.

Aren't you a big enough player to have your own recursive DNS, then?

Plus, if you get so much bandwidth from your provider, are they really still messing about with your DNS?

For the curious: https://www.t-mobile.com/coverage/coverage-map

> maybe you should vote with your wallet and change the ISP.

Not a lot an option for many, most of my life I've lived in areas that only have a single choice.

ISP's regularly resell subscriber data, including DNS requests. They're also more likely to "play ball" with authorities.

> we use a single resolver

Cloudflare is still doing BGP like your ISP.

This is simply unsubstantiated — there's absolutely no reason to believe Cloudflare won't play ball with authorities.

If anything, ISP DNS being a distributed system with independent ISPs all across the world, it would be much more difficult for the major agencies to control all the individual ISPs than it would be to simply control a single global entity with a US HQ and offices and POPs worldwide — Cloudflare.

They certainly make better privacy commitments and have more transparency than my ISP.

Cloudflare DNS supports DNS-over-HTTPS and DNS-over-TLS.

Cloudflare DNS claims to anonymize IPs in logs and only retain anonymized logs for 25 hours.[1]

Cloudflare has warrant canaries[2] and publishes transparency reports[3].

Many (most?) of us do not have more than one to two choices for an ISP. Voting with our wallet is not possible and doesn't even make sense for DNS.

I agree that centralizing under Cloudflare is unideal and I would gladly switch back to my ISP's DNS servers if they provided the same level of service and made similar commitments.

[1] https://blog.cloudflare.com/announcing-the-results-of-the-1-...

[2] https://www.cloudflare.com/learning/privacy/what-is-warrant-...

[3] https://www.cloudflare.com/transparency/

DNS is distributed, by design. Your ISP operates no differently than Cloudflare, and receives routing information from peers in the exact same way. There is nothing special or unique about consumer ISP-provided DNS. A DNS provider is either the definitive source and the buck stops there for a lookup, or it forwards to a peer for resolution.

Cloudflare is not a telecom, which comes with regulation baggage that can be enforced. This matters a lot to a subpoena.

I'm not quite sure I get your point.

I use the resolver of my ISP also, and they must recurse to cloudflare, because by default archive.is is broken for me at home.

I am not going to change my ISP and not going to bow down to a single website that chooses to go against the good faith of distributed systems.

I just don't visit their site anymore because that is the decision that they have made.