If I want my systems to fail in DNS resolution if the DHCP server doesn't give them a DNS server address (by design), I'm essentially SoL then? My option then i

If I want my systems to fail in DNS resolution if the DHCP server doesn't give them a DNS server address (by design), I'm essentially SoL then? My option then is to block outgoing TCP/UDP 53 on my firewall, except from my forwarders. Or maybe I should just suck it up and start building systemd in-house an give it a bogus default, with all the maintenance and overhead that involves? So, in a few months to a few years, when systemd silently switches to DNS over HTTPS, what then? Maintain a (growing) blacklist of public DoH servers? I'd much prefer my software to fail (and let me know), rather than assume some default someone, somewhere, somewhen thought a good idea.