I have deployed a DoH with a dynamically updated malware blocking which includes OSINT and data gathered through honeypot. It's url is https://proxy.wicked.us if anyone wants to give it a shot. Note that there is no logging of queries by design if your client uses Post requests. How can I improve this?