Similar here. I use Unbound DNS plus 1Hosts [1] and a few others here and there and I block all the DoH/DoT servers. I also blackhole route known malicious networks.

[1] - https://github.com/badmojr/1Hosts