If you change one thing after reading this, don't make it the resolver address in your router. Turn on encrypted DNS at the device instead, where your router can't quietly overrule it, then run those ...