Installed AdGuard Home on a Pi 4, set it as the default DNS assigned by DHCP across all my Ubiquiti APs.
Not only blocks ads, tracking, malware etc but also lets me use DoT/DoH/DNSCrypt across the whole WAN as the upstream.
Discussion
Which does kinda beg the question... why no built in support for encrypted DNS of any kind even with Ubiquiti?
Yeah I know setting up DNS on a Pi isn't exactly difficult. But it's still a basic feature that should be built into routers in 2023.