Replying to my own post: I hadn't looked into this recently but it looks like you can configure a pihole to use DoH for outbound requests: https://docs.pi-hol

Replying to my own post: I hadn't looked into this recently but it looks like you can configure a pihole to use DoH for outbound requests: https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/ So personally I plan to a) enable that so my outbound requests are encrypted, and then b) install a DNS blocklist so the hosts on my network will fall back to regular DNS and use the pihole. Best of both worlds!