How do you do the system wide DNS filtering?

pihole is one way, though it's tricky to do it right