If you don't want to host your own DNS, there are also managed options.

I pay for and use both Eero Secure (intercepts DNS requests sent to non-NextDNS servers) and NextDNS (set on my clients so it's also effective when away from home).