I set up systemd-resolved with the Quad9 DNS servers, with Cloudflare as backup. Quad9 is a Swiss DNS service that blocks malicious hosts and improves performance.