DNS66 from F-Droid works well. It routes all web traffic through a tunnel applying hosts file(s) to block domains associated with ads and other dodgy cruft.