You could block outbound DNS at the router/firewall, or conceivably transparently proxy it there. If these don't sound easy to you (and I'm guessing they don't, I don't know if anyone has even written ...

Privacy should be a human right, and not compromised for ease-of-use ...

Turns out my devices talk way too much.

I've always ended up needing to install something like openwrt on my routers. I'm not particularly interested in continuing to need to do that as this seems like an obvious feature people might need ...