For blocking I use Pi-hole https://pi-hole.net/ and unbound. I like the simple interface of the the Pi-Hole, point it to the locally running unbound which is configured to use several DoH providers I trust.
Thanks for PI-HOLE suggestion, pity its not available for FreeBSD, but still nice project.
Well, since its main use case is with a stand-alone Raspberry Pi, this shouldn’t be too much of an issue. Just treat it as an appliance, like a router.
It’s just based on dnsmasqd which I’m fairly sure is on FreeBSD. You can configure it yourself.