Security: they can hijack requests (BT does this in the UK to censor requests to certain domains). I believe some ISP's intercept all queries on port 53.
Privacy: your ISP has a log of the DNS queries you've made. (of course, they have a log of the IP addresses you've made HTTP/HTTPS requests to, so that may be less relevant).
>I believe some ISP's intercept all queries on port 53.
I'd say most ISPs do it nowadays including some datacentre providers. I only noticed it when my ISP screwed up their DNS proxy making all Cloudflare domains inaccessible no matter which DNS server I point queries to, the packets simply disappear down a black hole.
Jesus, that sucks. Do they also block VPNs, say on ports 80 and 443? Some VPNs use SSH and/or SSL (stunnel) for obfuscation. iVPN uses obfsproxy. A few use OpenVPN hacks, or proprietary obfuscation.
As far as I can tell, no. But their home broadband division is a spectacular mess of four quasi-autonomous networks acquired through mergers and buyouts, so your mileage may vary depending on which block you land upon.
After all, it is really a lazy way to save transit costs by making sure that domain names resolve to a CDN they have peered with, or in the worst case, to a transparent HTTP caching proxy they have set up.
Privacy: your ISP has a log of the DNS queries you've made. (of course, they have a log of the IP addresses you've made HTTP/HTTPS requests to, so that may be less relevant).