OPNsense DNS server must allow DNSSEC. If it uses unbound, like IPFire, I don’t think this is true. DNSSEC on the server side of a bit complicated, if not impossible.
For functions like adguard ( without storing information on extern servers ) I recommend the RPZ project