Microsoft plans to lock down Windows DNS like never before

This is a fabulous solution to a rather large issue that I've been personally experiencing (DNS poisoning), and, as a free software zealot, it feels rather strange to be cheering Microsoft on for promoting it.

It's worth noting that iOS has something similar within its Profiles framework, though not nearly as comprehensive.

You can create profiles that restrict the DNS servers the client can use as well as the domains those servers can resolve, with exceptions.

I've used this approach for years to implement DNS-level ad/tracker blocking without resorting to a loopback VPN. This site makes creating these profiles easy: https://dns.notjakob.com/