You can still use the default OpenDNS settings by changing the DNS servers to theirs: 208.67.222.222 and 208.67.220.220

Something I’ve not seen mentioned in the thread: a custom HOSTS file, such as Dan Pollock’s, goes a long way to blocking malicious domains and ads at the system level. This, in tandem with MS Defender and uBlock Origin (or similar browser extension) should eliminate a lot of infection risk.

+1 for having the day-to-day account be a standard account with a separate admin account with UAC requiring a password to gain elevated user rights. I am reasonably tech-savvy and I do all of the above.