I also will note you should add some catch all’s to block known dns ips like Google’s, as there are many devices with hard coded DNS in them that will bypass your DNS. I use opnsense and block all dns requests except to my adguard home + Google DNS Ips.