A once-and-for-all solution is provided via unbound, or dnscrypt-proxy. It is not recommended for beginners, but can be fun, digging in to. The task then remains to identify “trustworthy” DNS providers. But these can also be searched, according to their nation state, logging policy, etc.
A good introduction and walk-though of the topic is given here (in German). As always, DeepL delivers good (copy&paste) translations.