Fundamentally you have 3 problems 1. securing client - recursive resolver traffic 2. trusting the recursive resolver 3. securing recursive-authoritative traffi

Fundamentally you have 3 problems 1. securing client - recursive resolver traffic 2. trusting the recursive resolver 3. securing recursive-authoritative traffic. 1. and 2. can both be solved by running your own resolver, either locally, on your gateway or on a VPS reachable via VPN. But doing so makes you more vulnerable to 3. since fewer devices will be pooled behind a single resolver. Thus fixing 3 gives fundamentally a better improvement than futzing around with 1 or 2 where you're still at the mercy of a 3rd party. If you're serious about privacy then DoH/DNSCrypt-via-quad9/cloudflare/etc. just seem like a distraction. I mean sure, encrypting that traffic by default is not bad, but it's not a fundamental improvement. Also, I wouldn't say I trust my ISP, but at least it is under a GDPR jurisdiction. All the big resolvers that advertise encryption are under US jurisdiction, which makes any privacy promises seem hollow.