Here's an interesting bug. When I dig cdn.miau.pub with the @9.9.9.9 flag, I get the proper A record in response. When I do it without, and rely on DNS over TLS provided by the same 9.9.9.9 service, I get an SOA response. In real world terms, that means all the masto stuff hosted there is inaccessible to me. That's mildly annoying.