https://man.openbsd.org/unwind.8 uses libunbound; it detects whether local DHCP DNS is working, works correctly with captive portals, and supports opportunistic or strict DNSSEC.

This was discussed in https://news.ycombinator.com/item?id=19738313 in April