>"Quad9 blocks lookups of malicious host names from an up-to-the-minute list of threats. This blocking action protects your computer, mobile device, or IoT systems against a wide range of threats such as malware, phishing, spyware, and botnets, and it can improve performance in addition to guaranteeing privacy."
OK, let's understand the following:
Yes, it is absolutely true that there are malicious web sites, malicious API's, malicious endpoints on the Internet, most having hostnames, aka domain names, that can be blocked on lookup...
It is, generally speaking, a good idea to block malicious hostnames, malicious domain names, if they can be identified, if they can be known. And usually they can.
But there is a problem with performing such blocking however, and this is not a problem specific to Quad9 -- it's a problem for any DNS provider.
The problem can be simply stated as follows:
If you have the power to block any hostname, any domain name, any web service or web site whatsoever, then...
...how do you know that you are not accidentally blocking any legitimate, morally upstanding, ethically correct, legal, lawful, web services or websites, inadvertently?
?
In other words, for every 50,000 or so malicious domain names, how do you know that you didn't drag in at least one legitimate/legal/lawful one into that mix?
You see, it's philosophical question!
It's a variation of "Who guards the guardians?" (Quis custodiet ipsos custodes?https://en.wikipedia.org/wiki/Quis_custodiet_ipsos_custodes%...)
In other words, it raises such questions as "What's the resolution process if a lawful website is inadvertently blocked?" and "What is the criteria for blocking a website?" and "Who determines that criteria?", etc., etc.
Simply put: Who guards the guardians?
Now, this being said, we do appreciate everything that Quad9 and other free/privacy-focused DNS services do and provide.
We can make the counter-argument that privacy-focused DNS providers in general are "the good guys" and that for every 10,000+ domains with malicious intent, maybe only 1 or 2 actually legal, lawful, law-abiding domains are ever actually accidentally blocked -- and that would be a good counter-argument...
It's a great life to browsers to get rid of all of the malicious websites, but it's a horrendous life to individual legal lawful website owners when their ethical website is blocked for no apparent reason via an unaccountable non-transparent black-box service with no formal resolution process or channel!
Heard of "The Great Firewall of China"?
Most of that is implemented via DNS blocking!
Via DNS providers!
So in the future, I'd love to see a more, let's call it "responsibility-focused" DNS provider, one that at least attempts to notify any party that is blocked, notifies users of blocks, and has an open, public and transparent dispute resolution service for any party whose domain is blocked.
Anyway, in the interim, we thank Quad9 and the other privacy-focused DNS providers for their services!