I just do it all in my openwrt router now. Set up any DoH (https-dns-proxy) or DoT (stubby) with DNSSEC, plus blocklists with adblock-fast.
Hagezi has some servers with default blocking https://github.com/hagezi/dns-servers
https://github.com/hagezi/dns-blocklists#dnsservices
I was liking NextDNS, they have good features, and I liked not having to maintain blocklist files with shady domains in plain text saved in my hardware, but their jurisdiction and their code being closed source made me reevaluate.




Gee think long and hard about this.