Off the shelf router with DNSSEC/DNSCrypt

Solution
Highly unlikely on a consumer router. They to a point have been moving away from anything complex. They are selling to a market that gets confused if they can't take it out of the box and plug it in and it magically work with no configuration. This is why they still have WPS enabled by default on many routers even though it has been proven to be extremely insecure.

The only device I know that has it native are juniper devices that run junos. Likely many other brands of commercial firewall also have the support.

Asus merlin firmware may have it but there was a issue with a few years back, not sure if it was resolved. Then again if you are going to load merlin you might as well load dd-wrt.

Now you can get buffalo routers...
Highly unlikely on a consumer router. They to a point have been moving away from anything complex. They are selling to a market that gets confused if they can't take it out of the box and plug it in and it magically work with no configuration. This is why they still have WPS enabled by default on many routers even though it has been proven to be extremely insecure.

The only device I know that has it native are juniper devices that run junos. Likely many other brands of commercial firewall also have the support.

Asus merlin firmware may have it but there was a issue with a few years back, not sure if it was resolved. Then again if you are going to load merlin you might as well load dd-wrt.

Now you can get buffalo routers that have dd-wrt preloaded on them if you just don't want to load the firmware
 
Solution