take a look at adguard home, dnsmask or unbound. the best is to run your own infra