So having used many, many registrars both personally and for businesses, I would recommend the first year on namecheap, get that cheap price, before final 60 days are up, migrate it to cloudflare; only pay $10 in this case and they extend your remaining time over on them so you don't lose out on any cost you already paid to previous registrar. It's a no brainer. You pay at cost for domains at Cloudflare, but no cheap introductory price.
That also requires you to manage updates and security on that device... If you want less work not more zero trust cloudflare is a great free solution. I used to use nginx proxy manager which is free as a reverse proxy but again one less machine to worry about. I literally just migrated days ago and I couldn't be happier.
Correct. But not only port 53 but also 853. I would also suggest disabling ipv6 if it's unused as I've had services bypass my DNS with hardcoded ipv6 and ipv4 IPs as I mentioned before. Unless you absolutely need it for some reason.
I also will note you should add some catch all's to block known dns ips like Google's, as there are many devices with hard coded DNS in them that will bypass your DNS. I use opnsense and block all dns requests except to my adguard home + Google DNS Ips.
None of that is needed with cloudflare zero trust + tunneling. You simply install an agent on the machine and configure internal IP:port you want to access the outside in the cloudflare portal, pointing to a domain you own. You can even allow passwords to access internal IPs directly if you want.
Their upgrading to your area could add more hops to resolve your dns. Doesn't hurt to test. Can apply it to a single device with issue you mentioned, flush dns (or restart device) and see if it resolved the issue.
With his unpaid uh little elves.