Comment by pehtis

Another option would be to setup a wireguard server listening on 53. Wireguard traffic is UDP so it would work even if TCP DNS requests are blocked. And it would also make the client configuration much easier, ie just connect to the wireguard server.