Thanks a lot, that was what I looking for. Seems most realistic to configure DNS-over-TLS on the OS level then.