How to use Secure DNS on MacOS?
The easiest system-wide option is to use the third party utility “dnscrypt-proxy”:

https://github.com/jedisct1/dnscrypt-proxy

Follow their macOS guide to download, install and configure the program. This will essentially setup your system to that System Preferences show that your DNS server is 127.0.0.1 (localhost), which means that all programs using the system resolver sends their DNS requests to the proxy program running on your computer. The proxy program then handles the communication with external DNS servers using encryption.

You can download “dnscrypt-proxy switcher” to be able to quickly switch on/off the proxy usage from the menu bar.

Another possibility is to use only programs that in themselves support DNS-over-TLS or DNS-over-HTTPS. This is for example Firefox or Google Chrome. However, extra configuration is necessary.