Why does defaultDNS use Quad9's "Unsecured" service? (dns10/9.9.9.10 as opposed to dns/9.9.9.9)

[af3556]

The default upstream DNS server [defaultDNS](internal/dnsforward/dnsforward.go) uses https://dns10.quad9.net/dns-query, which Quad9 describe as:

Unsecured: No Malware blocking, no DNSSEC validation (for experts only!)

I'm wondering what benefits dns10 have over the "secured" https://dns.quad9.net/dns-query for AGH?

[schzhn]

By default, blocking DNS requests should be the responsibility of AdGuard Home, not the upstream DNS server.
Related #1451

[af3556]

So the rationale is "it may be confusing if something other than AdGuard Home is blocking DNS requests", which is fair enough, especially for an out-of-the-box default. Would it be worthwhile making a note in the docs to the effect of "the default upstream is unfiltered Quad9, you may want to consider switching to the standard servers, such as https://dns.quad9.net/dns-query, that provide their own security-focused protections" ?

[af3556]

FTR, I had been running dns.quad9.net for a few weeks, but hit a couple of hiccups where names were being blocked and it was rather unclear where - whether by AGH or upstream (turns out it was upstream). So I've reverted back to using the default dns10.quad9.net to eliminate one source of confusion, and can now see it's a sensible default ;-).