sc_·7 anni fa·discussI use unbound + dnscrypt-proxy + https://github.com/oznu/dns-zone-blacklist to do pretty much this. WireGuard also adds another layer & sets DNS easily per client. Hosted on a $5/month VPS, works very well.