[fChk]

You could add part on DoT .. by tls proxy (nginx, stubby can work) or server with direct support.

I've exclusively reserved this thread for DoH -as the title suggests- because of the fact that my HowTos are reports of actual implementations of projects on live VPSes. As of today, the only personal live system I've got is the one on NanoKVM platform which , as you may know, is a NAT-VPS. That means I don't have access to port 853, thus standard DoT deployment is impossible there.

It's for that reason that I didn't switch Apache Web Server (2.4.41) with Nginx. Nginx can be set to proxy both DoH and DoT traffics in the same setup. In the DoT mode, nginx-mod-stream package is needed (libnginx-mod-stream package in Debian) to

proxy plain TCP over to your DNS resolver solution

(systemd-resolved, Unbound, Bind/named, etc....) In this situation too Nginx should handles SSL termination.

People can use their own private dns in Android pi 9 and above with that.

Indeed, a private DoT server is ideal for people with devices supporting DoT natively (like Android Pie -9), or people in my situation with DNS issues with their ISP (check Heads-Up: Firefox rolling DNS-over-HTTPS (DoH) for the background story.)

Thanks for your input @rudra!