I'm using Unbound running on a dd-wrt router for a lot of this same functionality.
There are some things I don't do only because they aren't a priority for me. But I certainly got DNS over TLS and DNS blocking going.
I learnt about CoreDNS because Kubernetes uses it for service discovery, and once I read about it's "chaining plugins" philosophy I wanted to try it out.
And it was so refreshing coming from Dnsmasq that I fell in love with it.