If I understand correctly, I can't use any kind of DoH or DoT with the root nameservers or the nameservers for the main TLDs. Port 53 only. Is that correct? I heard Unbound supports DoT and DoH, but I'm guessing I would have to configure it to forward to a service like Cloudflare or Google. Is that about right?
I also would like to tighten things so devices don't bypass Pi-hole. I've turned on my router's DNS redirection and blocked port 853 on the firewall. Obviously I can't block 443, but is there a list of DoH endpoints I could block via Pi-hole?
Source: r/pihole · by /u/GoddammitDontShootMe