I just realised that if your router runs OpenWrt, you can install PiHole (an equivalent of, rather) directly onto your router by installing the following packages [1]
dnsmasq
adblock
luci-app-adblock
You may also need
libustream-mbedtls
Just tried it, works great. With a few small lists, the amount of blocked DNS requests is floating at around 30%.
https://command.honestsec.com sounds promising... looks like the system includes a secure router with secured double layer dns filtering (local at source and upstream resolver).
[1]: https://openwrt.org/docs/guide-user/services/ad-blocking