RethinkDNS does everything for me. You're tied to their DNS server if you want to use the in-app interface to make changes to the blocklists in use, but that's not a hard requirement. As a bonus, it also supports actual VPNs (wireguard, http connect, and socks proxy). If you don't care to micro-manage it, trackercontrol is also pretty good. There's other apps as well, like personalDNSfilter.