Google Public DNS Now Supports DNS-Over-TLS

  # Capture plain DNS requests and proxy them to DNS-over-TLS

  .:53 {
      forward . 127.0.0.1:5301 127.0.0.1:5302 127.0.0.1:5303 [::1]:5301 [::1]:5302 [::1]:5303
      log . {
          class error
      }
      cache
  }

  # Quad9 DNS. Differentiator: Automatically blocks domains known to be associated with malicious activity

  .:5301 {
      forward . tls://9.9.9.9 {
          tls_servername dns.quad9.net
      }
      cache
  }

  # Cloudflare. Differentiator: Fast and uses EDNS Padding

  .:5302 {
      forward . tls://1.1.1.1 tls://1.0.0.1 {
          tls_servername tls.cloudflare-dns.com
      }
      cache
  }

  # Google. Differentiator: ... Google?

  .:5303 {
      forward . tls://8.8.8.8 tls://8.8.4.4 {
          tls_servername dns.google
      }
      cache
  }

  # Google
  - address_data: 8.8.8.8
    tls_auth_name: "dns.google"
    tls_pubkey_pinset:
      - digest: "sha256"
        value: nxmRHK4Oq08HNWWYZwakeCHmiKvsDsEaBPS3blQ+nSE=
  - address_data: 8.8.4.4
    tls_auth_name: "dns.google"
    tls_pubkey_pinset:
      - digest: "sha256"
        value: nxmRHK4Oq08HNWWYZwakeCHmiKvsDsEaBPS3blQ+nSE=

  openssl s_client -connect '8.8.8.8:853' 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64

This is important for validating the TLS certificate that is provided by their servers on 8.8.8.8 and 8.8.4.4 (equivalent to requiring a matching hostname for TLS certificates in web browsers). I see that other commenters in this thread have correctly used this hostname in their examples for CoreDNS and Stubby.

Part of a configuration for the Unbound DNS server would look like:

  forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 8.8.8.8@853#dns.google
    forward-addr: 8.8.4.4@853#dns.google