Both static addressed devices and DHCP devices point to my internal AdGuard home server. Both my AdGuard server and the unbound in my Opnsense router use Quad9

Both static addressed devices and DHCP devices point to my internal AdGuard home server. Both my AdGuard server and the unbound in my Opnsense router use Quad9 over DoT AdGuard Home Server also point to Opnsense unbound to resolve local addresses All port 53 traffic not directed at my AdGuard is redirected to it. All port 53 traffic not to or from my adguard or opnsense is blocked. All DoT and DoH traffic not to or from my AdGuard or Opnsense is blocked. I also have a second AdGuard Home instance hosted in a VPS that i use for my mobile devices when outside my home network. I use a whitelist of ClientIDs so only my devices can use this server, weak authentication but it has worked so far. My home network is configured so that my devices will be redirected to my internal AdGuard server when at my home network and so they will use my public AdGuard server automaticaly when they are anywhere else. My firefox, edge and chrome at my laptops have a similar configuration using their own DoT/DoH resolver. For the OS i let it use whatever the DNS from the local network. In the near future i plan on replacing the Quad9 with my own recursive server hosted in the same VPS.