Single dot domain/DNS root zone query issue with containerized wireguard

make sure that for the Pi-hole Docker container both ports 53 TCP & UDP are port forwarded:

Yes both ports 53 TCP & UDP are forwarded.
My docker-compose

version: "3"

# More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/
services:
  pihole:
    container_name: pihole
    image: jacklul/pihole:latest
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "67:67/udp"
      - "8080:80/tcp"
    environment:
      TZ: 'Asia/Karachi'
      ADMIN_EMAIL: myemail@something.com
      WEBPASSWORD: 'somepassword'
      WEBTHEME: 'default-dark'
      PIHOLE_DNS_: '192.168.50.1'
      FTLCONF_REPLY_ADDR4: '<v4addressofpi>'
      FTLCONF_REPLY_ADDR6: '<v6addressofpi>'
    # Volumes store your data between container upgrades
    volumes:
      - './etc-pihole/:/etc/pihole/'
      - './etc-dnsmasq.d/:/etc/dnsmasq.d/'
      - './etc-pihole-updatelists/:/etc/pihole-updatelists/'
    #dns:
    #- 192.168.50.1
    #- 1.1.1.1
    # Recommended but not required (DHCP needs NET_ADMIN)
    #   https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
    # cap_add:
    #  - NET_ADMIN
    restart: unless-stopped

Also note that I am using DoT Cloudflare Zero Trust DNS (configured in my router). But note that issue was also occurring with public cloudflare's DNS that I was using while posting this question last year.

Let me search how to fix that MTU issue. I remember that pihole was showing some MTU related warnings some time ago but I couldn't find those warnings now.