Something to be aware of, some devices will straight ignore your DNS settings in DHCP if they can’t get to their ads. My iPhone 13 did that. I had to block port 53 udp/tcp for everything but the piholes.

I’m sure eventually we’re going to see DNS over https doing the same and I’m 100% ready to mitm all devices that pull that bullshit…