NextDNS was working a treat for me, and it was only through NextDNS's meticulous logging that I immediately discovered that my consumer grade router was hopelessly compromised: joined a botnet, trafficking porn, IDK.

So I threw the router out the window, and signed up to rent CPE from my ISP; edge router security is now 100% their responsibility!