Ideally integrated into the device that provides wifi, e.g. openwrt or dd-wrt running openvpn, and then get a monthly vpn service provider - always on at the local router level, for all of her devices.
I'd think not using the ISP's DNS server would be a good start. Either find one somewhere else or run your own.
Does this even help? Are DNS requests encrypted? I had thought that they were not.
They aren't.
algo[0] doens't require any client software so maybe set that up on her computer and she'll be set?