[bunnyfoofoo]

I love the inclusion of DNS here, as that was a major pain point on version 5. Currently on MacOS you can only use a single network filter, which Little Snitch is, so you couldn't use an encrypted DNS service easily in addition to Little Snitch. This made it an instant purchase for me (and it works).

[hi-v-rocknroll]

When on public networks, I use dnscrypt-proxy with a captive-portal compatible workaround.

When at home, I point the router to DoT non-logging servers and clients use the router for all domain resolution.