The only issue with next DNS is that it has no access to internal identities. If a system accessed a malicious site, I want to know which system. The best way of doing that is to self host.