Run dnscrypt-wrapper or unbound on your router. Then run dnscrypt-proxy or dnssec-trigger on your clients. You get secured against local-network DNS attacks, an

Run dnscrypt-wrapper or unbound on your router. Then run dnscrypt-proxy or dnssec-trigger on your clients. You get secured against local-network DNS attacks, and this let you use any upstream resolvers (or none).