Setting up an ad blocker for a whole device often requires root

Private DNS since Android 9 can do that without root access afaik, like with AdGuard’s public service