Have anyone tested OPNsense's resolvers?
https://www.saddns.net (https://www.saddns.net)
I found something about DNSCrypt Proxy, but I'm not sure about yet...
https://github.com/DNSCrypt/dnscrypt-proxy/issues/1508 (https://github.com/DNSCrypt/dnscrypt-proxy/issues/1508)
Not vulnerable using unbound im recursive mode.
(Obviously as ICMP to wan Is blocked and im on CG-NAT)