zlacker

To add, apparently another reason is that he believes using Cloudflare as your recursive resolver could lead to phishing[0]:

> the same entity which answers your DNS queries is able to issue SSL certs for any domain, so using CloudFlare DNS you never know whether you access the original website or a fishing one

Generally this is protected via certificate transparency+CAA records. If CF's CA were to issue a bad certificate, it'd be blocked by the browser and, should it get out, jeopardize the entire company, likely DigiCert as well given they cross-signed Cloudflare's issuing CA.

0: https://blog.archive.today/post/634795612966125568/when-will...