Pi-hole, unbound & DNSCrypt, DNS-over-HTTPS (DoH), DNS-over-TLS (DoT)

[Max-Mustermann]

Hi,
is there a way to use encrypted dns queries with Pi-hole / unbound?

There is a good how-to shown here (in german: https://forum.kuketz-blog.de/viewtopic.php?f=42&t=3067) in how to use pi-hole with unbound).

There is also mentioned that there are efforts ongoing to std. that
(https://tools.ietf.org/id/draft-bortzmeyer-dprive-resolver-to-auth-00.html)

It seems that adguard (https://adguard.com/de/adguard-dns/overview.html) is supporting dns encryption.

Is / will Pi-hole be able to use/support some kind of dns-crypt (in combination with unbound) currently/in the future?

[Bucking_Horn]

@Max-Mustermann

There is also mentioned that there are efforts ongoing to std. that

(I don't get the significance of that statement, but maybe that's not important.
The linked draft did expire on July 6, 2018.)

You certainly could configure unbound to forward DNS to an upstream DoT server, but that would be an unbound configuration issue - Pi-hole wouldn't be involved at all.

In addition, you should note that doing so would defeat the benefits of running unbound as recursive resolver.
You can either have
client ⇄ Pi-hole ⇄ unbound ⇄ (recurse authoritative name servers)
or
client ⇄ Pi-hole ⇄ unbound ⇄ dedicated DoT server.

If you want something like the latter, you could also substitute unbound and have Pi-hole talk to an encrypting DNS proxy of your choice:
client ⇄ Pi-hole ⇄ encrypting proxy ⇄ encrypting DNS server

Pi-hole just needs to be configured to use that encrypting DNS proxy of your choice as its only upstream DNS server.

[Max-Mustermann]

so it would be more an unbound question to encrypt the request to one of the 13 root servers (found in root.hints)?
I thought it could maybe handled via an dns-crypt proxy or via unbound itself?

Found nothing so far and pihole explains in the docs howto use unbound - so I thought someone could have an advice if/how encryption TO the rootserver could be managed ..... (pihole -> unbound -> root -> unbound -> pihole)

[Bucking_Horn]

@Max-Mustermann

so it would be more an unbound question to encrypt the request to one of the 13 root servers (found in root.hints)?

No, I didn't say that.
Read my answer again: You can either encrypt DNS or run a recursive resolver. The DNS root servers don't do encryption.

In addition, my advice was to substitute unbound with an encrypting DNS proxy of your choice if you opt for upstream DNS encryption.