dot.conf

# place in /etc/nginx/dns.d

stream {
    # DNS logging.  This log file will show the DNS requests geting forwarded to UNBOUND
    log_format  dns   '$remote_addr [$time_local] $protocol "$dns_qname"';
    access_log /var/log/nginx/dns-access.log dns; 

    # Include the NJS module.  Get the file from  https://github.com/TuxInvader/nginx-dns/tree/master/njs.d
    js_include /etc/nginx/njs.d/dns/dns.js;

    # The $dns_qname variable can be populated by preread calls, and can be used for DNS routing
    js_set $dns_qname dns.get_qname;

    # DNS upstream pool.  We use the local PIHOLE instance at 127.0.0.1:53.  
    # For bypassing PIHOLE and going directly to UNBOUD change the port to 5335
    upstream dns {
        zone dns 64k;
        server 127.0.0.1:53;  
    }

    # DNS over TLS (DoT) gateway.  Proxy the traffic onto standard DNS
    # Note that we're re-using the Let's Encrypt certificates
    server {
        listen 853 ssl;
        ssl_certificate /etc/letsencrypt/live/YourDNSServer/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/YourDNSServer/privkey.pem;
        js_preread dns.preread_dns_request;
        proxy_pass dns;
    }
}