Recursive DNS is still unencrypted and would be visible to your ISP
2,355 karma · joined March 30, 2019
If so, it's a hassle, but you can specify custom DNS servers (even DoH and DoT) for mobile connections using a .mobileconfig file. https://dns.notjakob.com/ can generate them for you.
Probably a good idea to do this anyway to keep your carrier from spying on your DNS requests.
Better to have the target blackholed upstream. Can usually be done with a BGP community of 666 if your peers support it.
3 years from the date of release is horrible. My iPhone 6S is coming up on 6 years of OS updates and will get at least 1 more with iOS 15.
Not to mention respecting the privacy of your users.
It used to be somewhat easier, but Nintendo surprisingly released an update last month (despite discontinuing the 3DS last year) that fixed the last exploit.
Not _yet_
Inversely, better IPv4 support: as a startup ISP you probably don't have much v4 space so you'll be relying on on CGNAT. But in the US at least, users have come to expect public IPv4 addresses. If that's too cost-prohibitive, at least make them available upon request or as a value-add.