> you can but if it cant resolve it will fallback to googles resolver automatically. At least this is what happened on my model.

I built my own router with a raspberry pi. I installed pi-hole and use that as a dns resolver. I then use an iptables rule to NAT / forward all dns traffic on port 53 to the pi-hole resolver, similar to how ISPs often intercept dns requests. This prevents IOT devices from bypassing the dns server configured via my DHCP. Letting pi-hole block the requests helps prevent errors from dns request timeouts.

DNS over HTTP has screwed this up.

I'm just waiting for smart devices to start doing that instead, forcing me to set up full SSL filtering until they start doing encrypted SNI :/

True, although then I’d lose trust in the devices and wouldn’t want to use them by that point anyway.

This method works really well.

I set my router dns to use the custom values nextdns provides for my account, which enabled it for the entire residence. It was fun to see the flotsam in the nextdns logs. I love this service.

you can but if it cant resolve it will fallback to googles resolver automatically. At least this is what happened on my model.

Yes, this happens. But then you make a firewall rule to route outbound port 53 traffic that doesn’t come from the Pihole to go back to the Pihole. It gets rather elaborate.