I avoid DHCP-provided DNS and use a local copy of unbound which does DNSSEC validation. A home I control the DHCP, but everywhere else, you can get any sort of custom crap.