devices -> AdGuard Home -> NextDNS,

And devices -> NextDNS as a fallback.

I see a lot of mentions for Pi-Hole, which is more or less the same thing as AdGuard Home. I just like AdGuard Home a little bit more:

- single binary go app

- easy to run in nonroot container (Pi-Hole only started supporting this last year)

- Native support for DoH upstream resolver

- YAML as configuration language with good versioning scheme and skew practices.