I have users on IE9 who cannot see my custom fonts. First I thought it was a CORS issue, but after some experimentation I believe it is because the security settings are such th
Here's a way to do it with conditional comments. I don't know how your fonts and other styles are organized, but you'll probably want to use
<!--[if IE 9]>
stylesheet using internally served fonts
<![endif]-->
and maybe
<!--[if !IE]> -->
stylesheet using CDN
<!-- <![endif]-->
The latter will apply not only to non-IE browsers but also to IE10 and up, but you might only need to use the former.
To answer your first question, I prefer using fonts from my own servers when in production. Cuts down on the number of moving parts and means that my site doesn't rely on another site.