I self-host my own DNS over TLS for domain-level adblocking. Maybe not the wisest decision, but it's working well so far and it doesn't require a lot of maintenance now that I've refined the setup.
I use a DNS registrar and certificate that support wildcards. That way, I don't have to leak my DoT subdomain and I gain some obfuscation. Android's Private DNS option doesn't support alternate ports, so I'm forced to use the default.
I use nginx as my reverse proxy and TLS terminator. At this stage, I apply rate limiting and subdomain filtering.
Then nginx forwards the streams to Unbound, which filters out any local IPs from the responses to avoid leaks.
Finally, Unbound forwards requests to my Pi-hole, where the magic happens.
I use a DNS registrar and certificate that support wildcards. That way, I don't have to leak my DoT subdomain and I gain some obfuscation. Android's Private DNS option doesn't support alternate ports, so I'm forced to use the default.
I use nginx as my reverse proxy and TLS terminator. At this stage, I apply rate limiting and subdomain filtering.
Then nginx forwards the streams to Unbound, which filters out any local IPs from the responses to avoid leaks.
Finally, Unbound forwards requests to my Pi-hole, where the magic happens.