I'm going to run PiHole with DoH on my Raspberry Pi and set the router's default DNS to it so that my ISP cannot tamper DNS lookups.