I have been looking into OpenDNS as something to possibly use at my company, and they claim that Cryptolocker-style ransomware almost always uses DNS to "phone home" and that OpenDNS blocks this, preventing the ransomware from doing anything malicious. This seems a bit dubious to me, as I would think that malware creators would either hardcode IPs or hardcode DNS server IPs (like a shady version of 18.104.22.168) instead of using the OS's default DNS server. I get that hardcoded IPs for the botnet-controller (or wherever the malware is phoning home to) would be problematic if that IP gets shut down or blocked, but I imagine they could use a different DNS that would continue to resolve their hostname even if they were using it nefariously.
Am I missing something? Is this truly how ransomware acts in the wild, or is this claim just marketing? Is there any technical reason ransomware would use the OS DNS server and couldn't use its own?