Unbound/Quad9/Both

Howdy all,

First off, I've been using pihole for a couple years and have loved every second of it. Not only the ad/tracker blocking but the added insight into my network (example: just noticed a spotify login failure loop from my stereo cos it was causing tens of thousands of extra queries)

I'm still learning, but currently trying to make another pass at security/privacy:

I've been using unbound, but in doing some reading have discovered that cached domains and recursion in Unbound both 'leak' the domains IP address to my ISP (and if ECH isn't supported the domain name too?).

However, if using Quad9 over DoH/DoT, the IP address is still 'leaked' but the domain name is obscured. What I can't quite parse yet is that if the only goal is obfuscation from the ISP, then:

-wouldn't using quad9 be better since the domain name is always hidden? This obviously requires absolute trust of Quad9, lets assume this as a given for arguments sake

-Since the domains IP address is never obscured from the ISP, couldn't the ISP just look up what domain is linked to that IP making all this moot?

-Or a hybrid of using cached DNS as normal but offloading the much more leaky recursion to Quad9?

I'm asking cos using a VPN on device still exposes my IP address as my DNS resolver and the solution (setting a VPN up on my router) is turning out to be a real pain.

Regardless, sorry if I'm woefully misunderstanding things. Trying to make sure the only money my ISP makes off of me is the money I pay them for access, and not them selling my data for extra profit:)