I have Adguard Home running on old AMD thin client/Ubuntu. Blocks Apple’s DNS, so in theory it should also prevent people from circumventing my stuff with Apple relay.