i think it's almost time to move from a blacklist situation like pi-hole/nextdns to an explicit allowlist of AS numbers or DNS hostnames that outbound traffic is permitted to access, with default deny. this is sad and annoying.