None of the above. Captive authentication portals are common in most "constantly changing" wireless client scenarios. Many use a DNS MITM approach that requires you to have working DNS service to the resolver you were provided by DHCP, and few today permit HTTPS service to DNS servers at any address, especially 1.1.1.1. Enforcing DNS-over-TLS, -HTTPS, or DNSSEC on your wireless client will not be a viable configuration in these real-world instances.