That's certainly an option if you want to run public DNS-over-HTTPS server, but you don't have to do that – DNSCloak do provide a way to specify a local blockli

That's certainly an option if you want to run public DNS-over-HTTPS server, but you don't have to do that – DNSCloak do provide a way to specify a local blocklist. DNS-over-HTTPS spec also mentioned that you can use a standard HTTP authentication if you want to run a DOH server but want to keep it private (although I've never tried this)