When on public networks, I use dnscrypt-proxy with a captive-portal compatible workaround.

When at home, I point the router to DoT non-logging servers and clients use the router for all domain resolution.