You shouldn’t trust your upstream provider if you use a major ISP. Most collect data not only from their own DNS servers but also unencrypted traffic over port

You shouldn’t trust your upstream provider if you use a major ISP. Most collect data not only from their own DNS servers but also unencrypted traffic over port 53 and then sell that data. Using NextDNS allows you to use encrypted DNS upstream (supported out the box with AdGuardHome, unlike pi-hole), meaning your ISP can’t as easily snoop on you. Of course, they still may be monitoring the hosts you connect to and the non-encrypted SNI requests, but that’s a lot more effort and most of the major US ISPs don’t do that at scale. DNS snooping does almost as well and is way easier.