nginx works very nicely as a DNS-over-TLS to DNS-over-TCP proxy, but yes you might want to choose stunnel instead if you don’t also want DoH. (I have run DoH a

nginx works very nicely as a DNS-over-TLS to DNS-over-TCP proxy, but yes you might want to choose stunnel instead if you don’t also want DoH. (I have run DoH and DoT in production since 2018, using OpenResty, i.e. nginx plus LuaJIT, with the DoH protocol conversion written by me in Lua, and DoT using basic nginx as described in TFA.)