Built-in support of DNS-over-HTTPS (DOH)

[yubiuser]

I think this is still out-of-scope:

Blocking DNS-over-HTTPS (DoH)

To the extent feasible, I'd like to be able to use a Pi-hole to block DNS over HTTPS (DoH), using approaches similar to those outlined here:

and

Implement DNS-over-TLS capability in Pi-hole

Yes and No. Yes: The DNS server in FTL is based on dnsmasq and, as such, is a DNS proxy that can either reply from its internal cache or has to forward the request to somewhere else. In the case of DoT, pihole-FTL forwards the requests to a local proxy which itself forwards it to Cloudflare using an encrypted connection. There are several complications when it comes to implementing this into pihole-FTL: There are different flavors of encrypted DNS traffic: DNS-over-TLS (DoT), DNS-over-HTTPS (…