@thomasfuchs self-hosted AdGuard Home in the frontend + Unbound in the backend. No third-parties, right to the root DNS servers.