what should my basic & advanced dns settings be?

[consorts]

i'm using merlin diversion skynet on ac3100; don't wanna mess it up
i noticed these settings and wondered if i should modify them at all.
my concerns are keeping dns encrypted and private from my isp,
and not risk falling for dns spoofing.

(not saved, just dotted "Yes" to display them all)
i thought DNSSEC support at least should be enabled, right?
what settings do you use in concert with my firmware combo.

above is my current leaktest off a wired pc on the lan of this router.

 

[bbunge]

First, the alt server for Quad9 is 149.112.112.112
Second, DNSSEC does not encrypt DNS communication. It does provide a validation of the results. DoT is provided by the Stubby add on.

Sent from my SM-T380 using Tapatalk

 

[consorts]

DoT is provided by the Stubby add on.

thanks for posting, most regulars here take for granted that new to merlin don't know what family of add-ons are currently relevant and compliment each other without blowing up their routers. so i added stubby today to my R3100 and while i'm a bit nervous being completely dependent on cloudflare, i can at least confirm my dns is being hidden from my isp's metadata vacuum cleaners...