The only true private DNS server is the one you own. It should be a recursive DNS server configured with DNS root zone and DNSSEC. So it would first contact one of the root DNS servers (obtained from ICANN), validate the authenticity of the response ensure it is not tampered with using DNSSEC, and then proceed to call the next server in the chain until the query is fully resolved. Such DNS server would bypass all censorships.
Also nice is that more and more root servers already support DoT meaning that the request and response would be encrypted preventing intermediaries like your ISP from seeing the data.
As a last resort, your DNS server can be hosted outside of the country on a server and then you'd connect to it over DoT or DoH.