I should really get around to installing dnscrypt-proxy… and now that I know about cloaking there is no reason not to go all-in. Also I was referred to some installation doco on #lobsters.