DNS over TLS uses a new port. If you're on an enterprise network, its firewall probably blocks that port.

DNS over HTTPS is being discussed to resolve that problem. The downside is it doesn't really exist yet.

DNSSEC doesn't do anything for query privacy (in other words: most of the reasons you'd use DNS-over-TLS aren't addressed by DNSSEC). DNSSEC is a bad standard whose primary impact on the Internet would be to replace the LetsEncrypt CA system with a PKI run by world governments. That sounds like something InfoWars would say, but I promise you, DNSSEC is weirder than InfoWars.

For now, the right answer is DNS over TLS.