Hacker News Reader

Protect it how exactly? You can create firewall rules on DigitalOcean and limit the IP addresses from which the DNS server is accessible.

that works only if you have a static ip home (which you usually don't have) or on your smartphone (which you don't have)

I have a ‘dynamic’ IP address at home that hasn’t changed for a few years. I have a slew of firewall rules based on it that are reliable in practice.

If you're that concerned about it, Wireguard is easy enough to set up on all those endpoints.