If you have a spare raspberry pi and don't mind an afternoon to get everything setup you could do what I have which is adguard home using the OISD block list and any other dns requests get resolved by unbound running on the same hardware so you're your own dns server.