I just use dnsmasq on top of of unbound on my router. My ISP could still see all the unbound requests to root servers, so if I cared more, I could use DNS-over-HTTPS to a VM somewhere ... but I have a local ISP and don't think it matters too much :blobcatshrug: