I do think ISPs should take a more active role is filtering DNS for their Customers, by default, but opt-out-able, against known-bad domains, or partner with public DNS providers for said service, and include options for blocking additional specific topics (ads, adult sites, gambling, social media, the usual suspects). It could be a value-add differentiator.

It should only be done as a Customer Service, however, and disclosed in a normal sized font and, as I said above, opt-out-able.

I would also extend this to say that ISPs should do the same for known-bad ASNs, and network ranges. Following on from yesterday's discussion about (p)residential proxies, blocking access to known C&C server domains and addresses at an ISP level would be a great solution.

I am, of course, looking at this through a utopian lens where ISPs aren't in bed with big tech and data brokers and other sketchy industries where profit can be made from selling out your customers' data. A 'real' ISP, you know, like 'no true scotsman'. It's all a question of trust and responsibility.

I pretty severely 'mess' with DNS on my home network and, damn, it makes using the Internet a much nicer experience. In fact, it makes using the Internet tolerable, where otherwise it is decidedly not. It could be classified as 'insecure' to not mess with DNS on any network[0].

[0]: https://www.pcmag.com/news/fbi-recommends-installing-an-ad-b...