My setup is similar: A server at home runs Unbound for recursive DNS, filtered by Hagezi's blacklists. The phone (running GrapheneOS) consumes the DNS service through a Wireguard tunnel. This is 100% self-hosted and does not rely on Tailscale or a third-party DNS service. All the mobile carrier or WiFi hotspot used sees is a single encrypted connection to the server.