I run an overkill system - a dnsdist instance provides clients on my network with DoH and standard port 53 resolution. Dnsdist forwards to a PowerDNS recursor for resolving internet hosts with root hints. Additionally, the recursor uses a custom Lua script with a Redis backend for firewalling against requests, responses, and nameservers encountered during iteration, and then all traffic is logged through protobuf interfaces with automated analysis that tell's me nothing I don't know since I live alone and baseline everything.

All outbound port 53 TCP/UDP is also forwarded at the firewall through this setup.