Cloudflare have launched a censored DNS product that blocks LGBTQ support sites
twitter.com
twitter.com
Since DNS already have some id fields, here's how they can potentially implement it:
When the user sign up and add devices, have them visit a unique subdomain to "activate" the device. On the load balancer level the device should be fingerprinted and stored, I think their VPN product already does this so it should be quite straightforward. Every DNS query can now be matched against a custom block list. Of course this would take more server resources. Cloudflare can turn this into a business opportunity by offering tiered plans, with higher level plans so that users can choose what to censor based on their own brand of politics, instead of a third party corporation. Or perhaps they can simply recover the additional server costs through selling analytics.
Clearly no diligence was done at all at Cloudflare. The entire idea of filtering for "adult" content at the DNS is fundamentally flawed, and clearly they just assumed they could buy something instead of realising no such list exists that isn't irredeemably toxic.