So I presume this means I have not been using DNSSEC?
I am running OpenWRT on my router and had it configured with the stubby package which (and I know just enough to be dangerous but not enough to be useful) uses DNSSEC and “Secure DNS” as alluded to on Cloudflare’s test site which I think is DNS over TLS (DoT). Just using 1.1.1.1 isn’t everything you can have configured in terms of secure DNS queries.
When I changed to just manually setting my WAN and WAN6 DNS servers to googles everything working again, but I don’t think I am using DoT in this setup. My next step to troubleshoot will be manually setting cloudflare’s without DoT and seeing if things continue to work. For now, I’ve been battling this for a week and I need some sleep!