dnscrypt-proxy[1], though you'll have to use something like iptables to redirect all DNS traffic to it

[1] - https://github.com/jedisct1/dnscrypt-proxy