Comment by ilikenwf

Depends on who the upstream provider is. Having a pihole or opnsense with dnscrypt and/or unbound setup is best.