This morning's successful DNS attack against Amazon and MyEtherWallet highlighted a few of the specific vulnerabilities that @Quad9DNS and @PCHglobal protect against, so we just drew this diagram to explain some of the weak links in the chain, and how we address them. 
The one thing that would have done the most to protect users from today's attack would have been DNSSEC validation. That wouldn't have prevented the attack, but it would have warned users that they were being man-in-the-middled, and ideally would have blocked the connection.
Quad9 uses DNSSEC validation, so if the MyEtherWallet domain were DNSSEC signed, we would have blocked the connection.
The BGP routing hijack against Amazon's IP addresses, which redirected recursive resolvers from Amazon's authoritative servers to the attacker's bogus servers depends upon the connection between recursive and authoritative servers being vulnerable.
Quad9 is the only recursive resolver which runs on the same platform as the world's largest authoritative server network, so all queries to domains for which PCH or anyone else on our platform is authoritative for, were completely protected against this form of attack.
That's not every domain, of course, and in particular, MyEtherWallet was using Amazon, which isn't on PCH's platform.
It's not possible to protect everyone from everything, but the combination of protections Quad9 and PCH offer would have fully protected both Quad9 users, and a company like MyEtherWallet, if they implemented best-practices like DNSSEC, or were on our authoritative platform.
