ping.nextdns.io errors

1. I'm on IPv4-only cellular network, but that shouldn't matter.

2. A couple of days ago the ping stopped working (see bellow). I didn't make any changes to my.nextdns.io settings that would have caused this.

anycast.dns1.nextdns.io error (anycast1)

anycast.dns2.nextdns.io error (anycast2)

dns1.nextdns.io error (ultralow1)

dns2.nextdns.io error (ultralow2)3. Queries to dns.nextdns.io/info & test.nextdns.io and dns.nextdns.io still work (see below -- and what's up with the garbled text in the query to dns.* -- is that suppoosed yo display as a unicode Flag emoji?):

dns.nextdns.io/info

{"locationName": "🇺🇸 Pittsburgh, United States", "pop": "cloudzy-pit", "rtt": 61370}

test.nextdns.io

"status": "ok",
"protocol": "DOH",
"profile": "*",
"client": "174.*.*.*",
"srcIP": "174.*.*.*",
"destIP": "45.90.28.0",
"anycast": true,
"server": "vultr-chi-1",
"clientName": "unknown-doh",
"deviceName": "*",
"deviceID": "*"
}

4. About a month ago, whenever I hit ping.nextdns.io (or the other status/test sites, i noticed "vercel.live" was being asked to resolve via nextdns.io logs. This is new, and it may be rated to problem (although the ping is broken no matter if I block vercel.live or not). I know that nextdns.io uses Vercel's infrastructure in certain ways, buf the query to vercel.live should not be happening, IMO. Only nextdns.io servers should be involved if this is to be a secure system.

• In fact, my.nextdns.io resolves to a CNAME vercel-dns.com (if I remember correctly, or something very similar). This is bad for multiple reasons: CNAME entries are easy to hijack, some browsers with strict security configurations reject the certificate because the CNAME doesn't match the my.nextdns.io domain name, and NextDNS should not be using CNAMES if they want to be taken seriously as a secure DNS provider.

• Furthetmore, my.nextdns.io lookup is NOT protected by DNSSEC. Neither are ping.* and test.*. In fact if you do not explicitly enter https://test... the site will default to unencrypted HTTP. Bad bug. my.*, ping.*, test.*, and router.* should all be HTTPS enforced and DNSSEC supported (just as favicon.nextdns.io & api.nextdns.io are).

5. Speaking of router.nextdns.io, thaf is completely unreachable now, begunnung about a month ago when this vercel.live server started appearing in the DNS logs.

Thanks much!