NGINX with DNS over TLS = only localhost

Thanks but that is for DNS over HTTPS. He uses a conf file for it but with TLS you will need to have a stream where that command isn't allowed like this:
https://www.bentasker.co.uk/documentation/linux/470-building-a-dns-over-tls-server