Nextdns.io and cloudflare externally. Pi-hole pointing to those internally. Preferably encrypted. Preferably with Firefox due to esni support.
One question popped into my head is how do you trust nextdns? or are you doing something so that you do not need to trust it?